Rule: S3 Buckets Should Prohibit Public Read Access

Rule Description:

Troubleshooting Steps:

2. 1.
   Identify S3 buckets: First, identify all the S3 buckets in your AWS account that may have public read access enabled.
4. 2.
   Check bucket permissions: Verify the permission settings for each S3 bucket to determine if public read access is allowed.
6. 3.
   Review access control lists (ACLs): Review the ACLs for each bucket and ensure that the "AllUsers" or "AuthenticatedUsers" group does not have read permissions.
8. 4.
   Review bucket policies: Check the bucket policies for any statements that allow public read access. Modify or remove those statements to restrict access.
10. 5.
    Review bucket-level public access settings: If your AWS account is using AWS Block Public Access settings, ensure that the "Block public access to buckets and objects granted through new public bucket or access point policies" option is enabled.
12. 6.
    Test access restrictions: Validate that public read access has been successfully disabled by attempting to access the bucket or its contents without proper authentication.

Necessary Codes:

Step-by-Step Guide for Remediation:

2. 1.
   Login to the AWS Management Console.
4. 2.
   Navigate to the Amazon S3 service.
6. 3.
   Identify the S3 bucket(s) requiring changes to prohibit public read access.
8. 4.
   Select the bucket name from the bucket list.
10. 5.
    Click on the "Permissions" tab.
12. 6.
    Review the "Access control list (ACL)" section.

    • If you find any entries granting "READ" access to "AllUsers" or "AuthenticatedUsers," proceed to step 7.
    • If no such entries are found, public read access is already prohibited. You can skip the remaining steps.
14. 7.
    Click on the "Access control list (ACL)" section to expand it.
16. 8.
    Locate the entry with "Grantee" set to "Everyone" or "AuthenticatedUsers" and "Permissions" set to "READ."
18. 9.
    Click on the "Remove" button or modify the permission to remove the "READ" access.
20. 10.
    Scroll down to the "Bucket policy" section.
22. 11.
    Review the bucket policy statements to ensure there are no statements allowing public read access.
24. 12.
    If any statements are found, modify or remove those statements to restrict access.
26. 13.
    Scroll further down to the "Public access" section.
28. 14.
    Ensure that the "Block public access to buckets and objects granted through new public bucket or access point policies" option is enabled.
30. 15.
    Click on "Save" or "Apply changes" to update the bucket settings.
32. 16.
    Repeat steps 4-15 for any other S3 buckets that require changes.
34. 17.
    Test the bucket access by attempting to access it or its contents without proper authentication. You should receive an access denied error if public read access is successfully prohibited.