S3 Bucket Public 'FULL_CONTROL' Access

01 Sign in to the AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Select the S3 bucket that you want to examine and click the Properties tab from the S3 dashboard top right menu:

04 In the Properties panel, click the Permissions tab and check the Access Control List (ACL) for any grantee named "Everyone". A grantee can be an AWS account or an AWS S3 predefined group. The grantee called "Everyone" is the predefined group that allows access to anonymous users. If the bucket ACL configuration does lists the "Everyone" predefined group with all the permissions enabled:

the selected S3 bucket is publicly accessible and insecure.

05 Repeat steps no. 3 and 4 for each S3 bucket that you want to examine, available in your AWS account.

01 Run list-buckets command (OSX/Linux/UNIX) to list all existing S3 buckets within your account:

aws s3api list-buckets
	--query 'Buckets[*].Name'

02 The command output should return the name of each S3 bucket available across all AWS regions:

[
    "webapp-status-reports",
    ...
    "webapp-data-repository"
]

03 Run get-bucket-acl command (OSX/Linux/UNIX) to return the access control policy for selected S3 bucket:

aws s3api get-bucket-acl
	--bucket webapp-data-repository

04 The command output should display the bucket policy document which contains the AWS users and groups that have access to the bucket and their level of permissions. If the Grantee group URI is equal to “http://acs.amazonaws.com/groups/global/AllUsers” (Everyone) and has the READ, WRITE, READ_ACP and WRITE_ACP permissions associated with it, the selected S3 bucket is not secured against unauthorized access. The following example displays an S3 bucket ACL policy that allows public access (FULL_CONTROL) to everyone:

{
    "Owner": {
        "DisplayName": "john.doe",
        "ID": "718f3e58089ec3bd00296f84056525d78415fd5e56d8309358e998965"
    },
    "Grants": [
        {
            "Grantee": {
                "Type": "Group",
                "URI": "http://acs.amazonaws.com/groups/global/AllUsers"
            },
            "Permission": "READ"
        },
        {
            "Grantee": {
                "Type": "Group",
                "URI": "http://acs.amazonaws.com/groups/global/AllUsers"
            },
            "Permission": "WRITE"
        },
        {
            "Grantee": {
                "Type": "Group",
                "URI": "http://acs.amazonaws.com/groups/global/AllUsers"
            },
            "Permission": "READ_ACP"
        },
        {
            "Grantee": {
                "Type": "Group",
                "URI": "http://acs.amazonaws.com/groups/global/AllUsers"
            },
            "Permission": "WRITE_ACP"
        }
    ]
}

05 Repeat steps no. 3 and 4 for each available S3 bucket that you want to examine.

01 Sign in to the AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Select the S3 bucket that you want to examine and click the Properties tab from the S3 dashboard top right menu:

04 In the Properties panel, click Permissions to expand the bucket Access Control List (ACL) configuration tab and search for the grantee (predefined group) named "Everyone".

05 Uncheck all the permissions applied to "Everyone":

or delete the predefined group using the x (delete) button:

06 Click Save to apply the new ACL configuration and remove the bucket public access.

07 Repeat steps no. 3 – 6 for each publicly accessible S3 bucket available in your AWS account.

01 Run list-buckets command (OSX/Linux/UNIX) to list all S3 buckets available in your account:

aws s3api list-buckets
	--query 'Buckets[*].Name'

02 The command output should return the name of each existing S3 bucket:

[
    "webapp-status-reports",
    ...
    "webapp-data-repository"
]

03 Run put-bucket-acl command (OSX/Linux/UNIX) using the bucket name as command parameter, to change the permissions and remove the public access (FULL_CONTROL access) for the selected S3 bucket (no output is returned):

aws s3api put-bucket-acl
	--bucket webapp-data-repository
	--acl private

04 Repeat step no. 3 for each publicly accessible S3 bucket within your AWS account.