Rule: S3 Buckets Should Prohibit Public Read Access

This rule ensures that S3 buckets do not allow public read access, in compliance with the SOC 2 security standard. Public read access means that anyone on the internet can view the objects stored in the bucket, which can lead to unauthorized access and potential data breaches.

To remediate this issue and prohibit public read access for the S3 buckets, follow the steps below:

First, you need to identify the S3 buckets that have public read access enabled. To do this, you can use the AWS Command Line Interface (CLI) or the AWS Management Console.

This command will list all the S3 buckets in your AWS account.

Once you have identified the S3 buckets with public read access, you need to update their access control lists (ACLs) or bucket policies to revoke public read permissions.

Replace

bucket-name

This command will update the bucket's ACL and set the access control to private, thereby revoking public read access.

If the S3 bucket has a bucket policy allowing public read access, you need to update the policy to deny public read permissions.

Use the following CLI command to retrieve the bucket policy:

Replace

bucket-name

Edit the bucket policy to deny public read access to the bucket. Remove any statements that grant public read access. Ensure that you retain any necessary permissions for authorized users or services.

Use the following CLI command to update the bucket policy:

Replace

bucket-name

path/to/policy.json

This command will update the bucket policy with the modified policy JSON file, effectively revoking public read access.

• If the AWS CLI commands mentioned above are not working, ensure that you have the necessary IAM permissions to manage S3 buckets and policies.
• Double-check the bucket names and policy syntax to ensure there are no discrepancies or typos.
• Review the AWS documentation for S3 bucket ACLs and policies for any additional troubleshooting steps specific to your use case.

Remember to regularly audit your S3 bucket access controls to ensure they align with the SOC 2 compliance requirements and best practices for security.