Homepage
About Snyk

S3 bucket has `block_public_acls` disabled Affecting S3 service in AWS

0.0
medium
0
10
    Severity Framework Snyk CCSS
    Rule category Data / Access Control

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    AWS-Well-Architected CIS-AWS CIS-Controls CSA-CCM GDPR HIPAA ISO-27001 NIST-800-53 SOC-2
  • Snyk ID SNYK-CC-00191
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Anyone who can manage the bucket's ACLs will be able to grant public access to the bucket.

How to fix?

Set the aws_s3_bucket_public_access_block or aws_s3_account_public_access_block block_public_acls field to true or use the default settings.

To enable block public access settings explicitly at the bucket level:

To enable block public access settings explicitly at the account level:

Example Configuration

# Enable for a single bucket
resource "aws_s3_bucket" "private" {
  acl           = "private"
  # other required fields here
}

resource "aws_s3_bucket_public_access_block" "private" {
  bucket                = "${aws_s3_bucket.private.id}"
  block_public_acls     = true
}

resource "aws_s3_bucket_ownership_controls" "private" {
  bucket = "${aws_s3_bucket.private.id}"
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_acl" "private" {
  depends_on = [aws_s3_bucket_ownership_controls.private]

  bucket = "${aws_s3_bucket.private.id}"
  acl    = "private"
}

# Enable for an entire AWS account
resource "aws_s3_account_public_access_block" "main" {
  block_public_acls     = true
}