Rule: S3 Buckets Should Prohibit Public Read Access

Rule Description:

Troubleshooting Steps (if applicable):

2. 1.

   Identify the S3 bucket with public read access:

   • Navigate to the AWS Management Console.
   • Go to the S3 service.
   • List all the available buckets.
   • Look for buckets with public read access enabled.
4. 2.

   Audit the contents of the bucket:

   • Review the files and objects stored in the bucket for any sensitive or confidential information.
6. 3.

   Disable public read access:

   • Select the bucket with public read access.
   • Click on the "Permissions" tab.
   • Identify the "Access control list (ACL)" section.
   • Remove all public read permissions assigned to the bucket.
8. 4.

   Restrict access using bucket policies:

   • Click on the "Permissions" tab.
   • Identify the "Bucket Policy" section.
   • Create or modify a bucket policy to deny public read access.
   • Example bucket policy to deny public read access:

     {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DenyPublicReadAccess",
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::bucket-name/*"
            }
        ]
     }
     
10. 5.

    Regularly monitor and review S3 bucket permissions:

    • Implement a process to review and audit the permissions of S3 buckets periodically.
    • Ensure that public read access is not re-enabled accidentally.
12. 6.

    Educate and enforce best practices:

    • Train and educate users who manage S3 buckets on the importance of restricting public read access.
    • Enforce policies and guidelines that prohibit enabling public read access without proper justification and approval.