Project: KICS (Provisioning / Security & Compliance)
File: 835d5497-a526-4aea-a23f-98a9afd1635f.md

title: S3 Bucket ACL Allows Read to Any Authenticated User hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 835d5497-a526-4aea-a23f-98a9afd1635f Query name: S3 Bucket ACL Allows Read to Any Authenticated User Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: S3 Buckets should not be readable to any authenticated user<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts01: Type: AWS::S3::Bucket Properties: AccessControl: AuthenticatedRead BucketName: jenkins-artifacts Tags: Key: CostCenter Value: ITEngineering ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: StaticPage01: Type: AWS::S3::Bucket Properties: AccessControl: AuthenticatedRead BucketName: public-read-static-page01 WebsiteConfiguration: ErrorDocument: 404.html IndexDocument: index.html Tags: Key: CostCenter Value: ITEngineering ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts02: Type: AWS::S3::Bucket Properties: AccessControl: AuthenticatedRead BucketName: jenkins-artifacts-block-public PublicAccessBlockConfiguration: BlockPublicPolicy: false VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: ITEngineering Key: Type Value: CICD ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: S3BucketForWebsiteContent: Type: AWS::S3::Bucket Properties: AccessControl: AuthenticatedRead WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts01": { "Properties": { "AccessControl": "AuthenticatedRead", "BucketName": "jenkins-artifacts", "Tags": [ { "Value": "ITEngineering", "Key": "CostCenter" } ] }, "Type": "AWS::S3::Bucket" } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "StaticPage01": { "Properties": { "AccessControl": "AuthenticatedRead", "BucketName": "public-read-static-page01", "WebsiteConfiguration": { "ErrorDocument": "404.html", "IndexDocument": "index.html" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" } ] }, "Type": "AWS::S3::Bucket" } } } ``` </details> <details><summary>Positive test num. 7 - json file</summary> ```json hl_lines="20" { "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts02": { "Type": "AWS::S3::Bucket", "Properties": { "VersioningConfiguration": { "Status": "Enabled" }, "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" }, { "Key": "Type", "Value": "CICD" } ], "AccessControl": "AuthenticatedRead", "BucketName": "jenkins-artifacts-block-public", "PublicAccessBlockConfiguration": { "BlockPublicPolicy": false } } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` </details> <details><summary>Positive test num. 8 - json file</summary> ```json hl_lines="7" { "Description": "Creating S3 bucket", "Resources": { "S3BucketForWebsiteContent": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "AuthenticatedRead", "WebsiteConfiguration": { "IndexDocument": "index.html", "ErrorDocument": "error.html" } } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` </details> ```yaml title="Negative test

1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts03: Type: AWS::S3::Bucket Properties: AccessControl: BucketOwnerFullControl BucketName: jenkins-artifacts VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: ITEngineering Key: Type Value: CICD ``` ```yaml title="Negative test num. 2 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts04: Type: AWS::S3::Bucket Properties: AccessControl: Private BucketName: jenkins-secret-artifacts VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: '' ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: JenkinsArtifacts05: Type: AWS::S3::Bucket Properties: AccessControl: PublicReadWrite BucketName: jenkins-secret-artifacts2 VersioningConfiguration: Status: Enabled Tags: Key: CostCenter Value: ITEngineering ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml AWSTemplateFormatVersion: 2010-09-09 Description: Creating S3 bucket Resources: StaticPage03: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead BucketName: public-read-static-page WebsiteConfiguration: ErrorDocument: 404.html IndexDocument: index.html Tags: Key: CostCenter Value: ITEngineering Outputs: WebsiteURL: Value: Fn::GetAtt: StaticPage03 WebsiteURL Description: URL for website hosted on S3 S3BucketSecureURL: Value: Fn::Join: "" - https:// Fn::GetAtt: StaticPage03 DomainName Description: Name of S3 bucket to hold website content ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts03": { "Type": "AWS::S3::Bucket", "Properties": { "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" }, { "Key": "Type", "Value": "CICD" } ], "AccessControl": "BucketOwnerFullControl", "BucketName": "jenkins-artifacts", "VersioningConfiguration": { "Status": "Enabled" } } } } } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts04": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "Private", "BucketName": "jenkins-secret-artifacts", "VersioningConfiguration": { "Status": "Enabled" }, "Tags": [ { "Key": "CostCenter", "Value": "" } ] } } } } ``` </details> <details><summary>Negative test num. 7 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket", "Resources": { "JenkinsArtifacts05": { "Properties": { "BucketName": "jenkins-secret-artifacts2", "VersioningConfiguration": { "Status": "Enabled" }, "Tags": [ { "Value": "ITEngineering", "Key": "CostCenter" } ], "AccessControl": "PublicReadWrite" }, "Type": "AWS::S3::Bucket" } } } ``` </details> <details><summary>Negative test num. 8 - json file</summary> ```json { "Resources": { "StaticPage03": { "Type": "AWS::S3::Bucket", "Properties": { "Tags": [ { "Key": "CostCenter", "Value": "ITEngineering" } ], "AccessControl": "PublicRead", "BucketName": "public-read-static-page", "WebsiteConfiguration": { "ErrorDocument": "404.html", "IndexDocument": "index.html" } } } }, "Outputs": { "WebsiteURL": { "Value": { "Fn::GetAtt": [ "StaticPage03", "WebsiteURL" ] }, "Description": "URL for website hosted on S3" }, "S3BucketSecureURL": { "Description": "Name of S3 bucket to hold website content", "Value": { "Fn::Join": [ "", [ "https://", { "Fn::GetAtt": [ "StaticPage03", "DomainName" ] } ] ] } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Creating S3 bucket" } ``` </details>