Control: 4.1.1 Ensure no Object Storage buckets are publicly visible

Description

A bucket is a logical container for storing objects. It is associated with a single compartment that has policies that determine what action a user can perform on a bucket and on all the objects in the bucket. It is recommended that no bucket be publicly accessible.

Remediation

From Console

1. Login to OCI Console.
2. Click in the search bar, top of the screen.
3. Type Advanced Resource Query and click enter.
4. Click the Advanced Resource Query button in the upper right of the screen.
5. Enter the following query in the query box:

query
bucket resources
where (publicAccessType == 'ObjectRead') || (publicAccessType == 'ObjectReadWithoutList')

6. For each bucket in the returned results, click the Bucket Display Name.
7. Click Edit Visibility.
8. Select Private.
9. Click Save Changes.

From Command Line

1. Execute the following command:

oci search resource structured-search --query-text "query bucket resources
where (publicAccessType == 'ObjectRead') || (publicAccessType == 'ObjectReadWithoutList')"

2. Ensure query returns no results

3. For each of the buckets identified get the bucket name

oci os bucket update --bucket-name <bucket-name> --public-access-type NoPublicAccess