Control: 12 S3 access control lists (ACLs) should not be used to manage user access to buckets
Description
This control checks whether Amazon S3 buckets provide user permissions via ACLs. The control fails if ACLs are configured for managing user access on S3 buckets.
ACLs are legacy access control mechanisms that predate IAM. Instead of ACLs, we recommend using IAM policies or S3 bucket policies to more easily manage access to your S3 buckets.
Remediation
For more information on managing access to S3 buckets, see Bucket policies and user policies in the Amazon S3 User Guide. For details on how to review your current ACL permissions, see Access control list (ACL) overview in the Amazon S3 User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_s3_12Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_s3_12 --shareSQL
This control uses a named query:
s3_bucket_acls_should_prohibit_user_access