acquires Cloud Conformity
Open menu

S3 Bucket Authenticated Users 'READ_ACP' Access

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features
Knowledge Base Best practice rules for Amazon Web Services AWS S3 Best Practices S3 Bucket Authenticated Users 'READ_ACP' Access
Security
Risk level: Very High (not tolerated)
Rule ID: S3-007

Ensure that your S3 buckets content permissions cannot be viewed by AWS authenticated accounts or IAM users in order to protect against unauthorized access. An S3 bucket that grants READ_ACP (VIEW PERMISSIONS) access to AWS signed users can allow them to examine your S3 Access Control Lists (ACLs) configuration details and find permission vulnerabilities.

This rule can help you with the following compliance standards:

This rule can help you work with the AWS Well-Architected Framework

This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS

Granting authenticated “READ_ACP” access to S3 buckets can allow AWS unauthorized users to see who controls your objects and how. Malicious users can use this information to find S3 objects with misconfigured permissions and implement probing methods to facilitate access to your S3 data. Cloud Conformity strongly recommends against setting READ_ACP (VIEW PERMISSIONS) ACL permission for the "Any Authenticated AWS User" ACL predefined group in production.

Audit

To determine if your S3 buckets allow READ_ACP access to AWS authenticated users, perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Select the S3 bucket that you want to examine and click the Properties tab from the S3 dashboard top right menu:

Properties tab from the S3 dashboard top right menu

04 In the Properties panel, click the Permissions tab and check the Access Control List (ACL) for any grantee named "Any Authenticated AWS User". A grantee can be an AWS account or an AWS S3 predefined group. The grantee called "Any Authenticated AWS User" is an AWS predefined group that allows any authenticated AWS account or IAM user to access the S3 bucket. If the bucket ACL configuration displays the "Any Authenticated AWS User" predefined group with the View Permissions (READ_ACP) permissions enabled:

'Any Authenticated AWS User' predefined group with the View Permissions (READ_ACP) permissions enabled

the selected S3 bucket permissions are clearly exposed to other AWS authenticated users and the bucket is rendered as insecure.

05 Repeat steps no. 3 and 4 for each bucket that you want to examine, available in your AWS account.

Using AWS CLI

01 Run list-buckets command (OSX/Linux/UNIX) to list all existing S3 buckets within your account: 

aws s3api list-buckets
	--query 'Buckets[*].Name'

02 The command output should return the name of each S3 bucket available: 

[
    "internal-status-reports",
     ...
    "annual-internal-financial-reports"
]

03 Run get-bucket-acl command (OSX/Linux/UNIX) to return the Access Control Policy (ACP) for selected bucket. The following command example expose the ACP for an S3 bucket named annual-internal-financial-reports: 

aws s3api get-bucket-acl 
	--bucket annual-internal-financial-reports

04 The command output should display the bucket policy document which contains the AWS users and groups that have access to the bucket and their level of permissions. If the Grantee group URI is equal to “http://acs.amazonaws.com/groups/global/AuthenticatedUsers” (Any Authenticated AWS User) and the permission associated with the grantee is READ_ACP, the selected S3 bucket ACL information is accessible to other AWS users and the bucket is vulnerable to intrusion. The following CLI output example displays an S3 bucket Access Control Policy (ACP) that allows public READ_ACP access to any authenticated AWS user: 

{
    "Owner": {
        "DisplayName": "john.doe",
        "ID": "674f3e58089ec3bd00296f84056525d78415fd5e56dcfda3f8309358e9989663"
    },
    "Grants": [
        {
           "Grantee": {
               "Type": "Group",
               "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers"
           },
           "Permission": "READ_ACP"
        }
    ]
}

05 Repeat steps no. 3 and 4 for each AWS S3 bucket that you want to examine.

Remediation / Resolution

To remove authenticated READ_ACP access for your S3 buckets ACL configuration, you need to perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Select the S3 bucket that you want to examine and click the Properties tab from the S3 dashboard top right menu:

Properties tab from the S3 dashboard top right menu

04 In the Properties panel, click Permissions to expand the bucket Access Control List (ACL) configuration tab and search for the grantee (predefined group) named "Any Authenticated AWS User".

05 Uncheck the View Permissions (READ_ACP) permission applied to "Any Authenticated AWS User":

Uncheck the View Permissions (READ_ACP) permission applied to 'Any Authenticated AWS User'

or delete the predefined group using the x button next to the group permission settings:

delete the predefined group using the x button next to the group permission settings

06 Click Save to apply the new ACL configuration and remove the bucket authenticated READ_ACP access.

07 Repeat steps no. 3 – 6 for each authenticated “READ_ACP” accessible S3 bucket available in your AWS account.

Using AWS CLI

01 Run list-buckets command (OSX/Linux/UNIX) to list all existing S3 buckets available in your account:

aws s3api list-buckets
	--query 'Buckets[*].Name'

02 The command output should return the name of each S3 bucket available across all AWS regions: 

[
    "internal-status-reports",
     ...
    "annual-internal-financial-reports"
]

03 Run put-bucket-acl command (OSX/Linux/UNIX) using the bucket name as command input parameter, to update the ACL configuration and hide the permissions information for the selected S3 bucket (if successful, the command should not return any output): 

aws s3api put-bucket-acl
	--bucket annual-internal-financial-reports
	--acl private

04 Repeat step no. 3 for each authenticated “READ_ACP” accessible S3 bucket within your AWS account.

References

Publication date May 14, 2016

Related S3 rules

Thanks!

A verification email has been sent to

Thanks!

A verification email has been sent to

Thanks!

A verification email has been sent to