Project: KICS (Provisioning / Security & Compliance)
File: 219f4c95-aa50-44e0-97de-cf71f4641170.md

title: S3 Bucket ACL Allows Read to All Users hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 219f4c95-aa50-44e0-97de-cf71f4641170 Query name: S3 Bucket ACL Allows Read to All Users Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: S3 Buckets should not be readable to all users<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts01: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead BucketName: jenkins-artifacts Tags: Key: CostCenter Value: ITEngineering ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: StaticPage01: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead BucketName: public-read-static-page01 WebsiteConfiguration: ErrorDocument: 404.html IndexDocument: index.html Tags: Key: CostCenter Value: ITEngineering ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts02: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead BucketName: jenkins-artifacts-block-public PublicAccessBlockConfiguration: BlockPublicPolicy: false VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: ITEngineering Key: Type Value: CICD ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: S3BucketForWebsiteContent: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="13" { "Resources": { "JenkinsArtifacts01": { "Type": "AWS::S3::Bucket", "Properties": { "BucketName": "jenkins-artifacts", "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" } ], "AccessControl": "PublicRead" } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket" } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="7" { "Description": "Creating S3 bucket", "Resources": { "StaticPage01": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "PublicRead", "BucketName": "public-read-static-page01", "WebsiteConfiguration": { "IndexDocument": "index.html", "ErrorDocument": "404.html" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" } ] } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` </details> <details><summary>Positive test num. 7 - json file</summary> ```json hl_lines="8" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts02": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "PublicRead", "BucketName": "jenkins-artifacts-block-public", "PublicAccessBlockConfiguration": { "BlockPublicPolicy": false }, "VersioningConfiguration": { "Status": "Enabled" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" }, { "Key": "Type", "Value": "CICD" } ] } } } } ``` </details> <details><summary>Positive test num. 8 - json file</summary> ```json hl_lines="8" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "S3BucketForWebsiteContent": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "PublicRead", "WebsiteConfiguration": { "IndexDocument": "index.html", "ErrorDocument": "error.html" } } } } } ``` </details> ```yaml title="Negative test

1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts03: Type: AWS::S3::Bucket Properties: AccessControl: BucketOwnerFullControl BucketName: jenkins-artifacts VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: ITEngineering Key: Type Value: CICD ``` ```yaml title="Negative test num. 2 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts04: Type: AWS::S3::Bucket Properties: AccessControl: Private BucketName: jenkins-secret-artifacts VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: ITEngineering ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts05: Type: AWS::S3::Bucket Properties: AccessControl: PublicReadWrite BucketName: jenkins-secret-artifacts2 VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: ITEngineering ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: StaticPage03: Type: AWS::S3::Bucket Properties: AccessControl: AuthenticatedRead BucketName: public-read-static-page WebsiteConfiguration: ErrorDocument: 404.html IndexDocument: index.html Tags: Key: CostCenter Value: ITEngineering Outputs: WebsiteURL: Value: Fn::GetAtt: StaticPage03 WebsiteURL Description: URL for website hosted on S3 S3BucketSecureURL: Value: Fn::Join: "" - https:// Fn::GetAtt: StaticPage03 DomainName Description: Name of S3 bucket to hold website content ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts03": { "Type": "AWS::S3::Bucket", "Properties": { "BucketName": "jenkins-artifacts", "VersioningConfiguration": { "Status": "Enabled" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" }, { "Key": "Type", "Value": "CICD" } ], "AccessControl": "BucketOwnerFullControl" } } } } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts04": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "Private", "BucketName": "jenkins-secret-artifacts", "VersioningConfiguration": { "Status": "Enabled" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" } ] } } } } ``` </details> <details><summary>Negative test num. 7 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts05": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "PublicReadWrite", "BucketName": "jenkins-secret-artifacts2", "VersioningConfiguration": { "Status": "Enabled" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" } ] } } } } ``` </details> <details><summary>Negative test num. 8 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "StaticPage03": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "AuthenticatedRead", "BucketName": "public-read-static-page", "WebsiteConfiguration": { "ErrorDocument": "404.html", "IndexDocument": "index.html" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" } ] } } }, "Outputs": { "S3BucketSecureURL": { "Value": { "Fn::Join": [ "", [ "https://", { "Fn::GetAtt": [ "StaticPage03", "DomainName" ] } ] ] }, "Description": "Name of S3 bucket to hold website content" }, "WebsiteURL": { "Value": { "Fn::GetAtt": [ "StaticPage03", "WebsiteURL" ] }, "Description": "URL for website hosted on S3" } } } ``` </details>