All checks
High
S3 general purpose bucket policies should restrict access to other AWS accounts
Checks that the S3 general purpose bucket's policy does not allow another AWS account, or everyone, s3:DeleteBucketPolicy, s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutEncryptionConfiguration or s3:PutObjectAcl, which would let them change the bucket's access or encryption. A Condition on the Allow, such as aws:PrincipalOrgID, is not read.
- service
- S3
- severity
- High
- scope
- evaluated once per account
How to fix it
- Can break clients: Once saved, the other account can no longer change this bucket's policy, ACLs or encryption, so confirm nothing it runs still does.
In the console
S3 → the bucket → Permissions → Bucket policy
- Action
- None of the five in an Allow to another account, including through a wildcard such as s3:Put* or s3:*
- Principal
- Only your own account's principals or a service, in an Allow of those actions; "*" and any NotPrincipal count as outside
- Effect
- Or keep the Allow and add a Deny of those actions on its resources to "*" unless aws:PrincipalAccount is yours
With the AWS CLI
- Overwrites existing settings: The CLI route replaces the whole bucket policy, so edit the current policy rather than sending only the changed statements.
aws s3api put-bucket-policy --bucket <bucket> --policy file://bucket-policy.jsonSee which of your accounts this check is failing on.
Book a live scan