Back to All Checks
Medium S3

ACLs should not be used to manage user access to S3 general purpose buckets

NISTISO 27001HIPAA

Description

Flags S3 buckets that use ACLs to manage user access, which should be replaced with bucket policies.

Remediation

Disable ACLs by setting Object Ownership to 'Bucket owner enforced'.

Steps

  1. Sign in to the AWS Management Console and open the Amazon S3 console.
  2. Select the bucket and choose the 'Permissions' tab.
  3. Under 'Object Ownership', click 'Edit'.
  4. Select 'Bucket owner enforced' to disable ACLs.
  5. Save changes.

Compliance

NISTISO 27001HIPAA
Start Your Free Security Check