Control: 3 S3 buckets should prohibit public write access
Description
This control checks whether your S3 buckets allow public write access by evaluating the Block Public Access settings, the bucket policy, and the bucket access control list (ACL).
It does not check for write access to the bucket by internal principals, such as IAM roles. You should ensure that access to the bucket is restricted to authorized principals only.
Remediation
- Open the Amazon S3 console.
- Choose the name of the bucket identified in the finding.
- Choose Permissions and then choose Public access settings.
- Choose Edit, select all four options, and then choose Save.
- If prompted, enter
confirmand then choose Confirm.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_s3_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_s3_3 --shareSQL
This control uses a named query:
s3_bucket_restrict_public_write_access