S3 Bucket Public 'WRITE' Access

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features

Knowledge Base Amazon Web Services Amazon S3 S3 Bucket Public 'WRITE' Access

Risk level: Very High (not tolerated)

Rule ID: S3-003

Ensure that your AWS S3 buckets cannot be publicly accessed for WRITE actions in order to protect your S3 data from unauthorized users. An S3 bucket that allows WRITE (UPLOAD/DELETE) access to everyone (i.e. anonymous users) can provide attackers the capability to add, delete and replace objects within the bucket, which can lead to S3 data loss or unintended charges on your AWS bill.

This rule can help you with the following compliance standards:

This rule can help you work with the AWS Well-Architected Framework

This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS

Security

Granting public "WRITE" access to your AWS S3 buckets can allow anonymous users to upload, modify and delete S3 objects without permission. Cloud Conformity strongly recommends against setting WRITE (UPLOAD/DELETE) permission for the "Everyone" predefined group in production.

Audit

To determine if your existing AWS S3 buckets allow public WRITE access, perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Select the S3 bucket that you want to examine and click the Properties tab from the S3 dashboard top right menu:

04 In the Properties panel, click the Permissions tab and check the Access Control List (ACL) configuration for any grantee named "Everyone". A grantee can be an AWS account or an AWS S3 predefined group. The grantee called "Everyone" is an AWS predefined group that allows access to everyone on the Internet. If the bucket ACL configuration does lists the "Everyone" predefined group with the Upload/Delete (WRITE) permissions enabled:

If the bucket ACL configuration does lists the 'Everyone' predefined group with the Upload/Delete

the selected S3 bucket is publicly accessible for unrestricted content updates (add/delete/replace objects) and is rendered as insecure.

05 Repeat steps no. 3 and 4 for each AWS S3 bucket that you want to examine.

Using AWS CLI

01 Run list-buckets command (OSX/Linux/UNIX) to list all existing S3 buckets within your account:

aws s3api list-buckets
	--query 'Buckets[*].Name'

02 The command output should return the name of each S3 bucket available across all AWS regions. The following output example returns an S3 bucket named webapp-data-repository:

[
    "webapp-data-repository"
]

03 Run get-bucket-acl command (OSX/Linux/UNIX) to return the access control policy (ACP) for selected S3 bucket:

aws s3api get-bucket-acl
	--bucket webapp-data-repository

04 The command output should display the bucket ACL policy document which contains the AWS users and groups that have access to the bucket and their level of permissions. If the Grantee group URI is equal to “http://acs.amazonaws.com/groups/global/AllUsers” (Everyone) and the permission associated with the group is WRITE, the selected bucket is publicly accessible for updates, hence insecure. The following example displays an S3 bucket ACP that allows public WRITE access to everyone on the Internet:

{
    "Owner": {
        "DisplayName": "john.doe",
        "ID": "348f3e58089ec3bd00296f84056525d78415fd5e56dcfda3f809355f3"
    },
    "Grants": [
        {
            "Grantee": {
                "Type": "Group",
                "URI": "http://acs.amazonaws.com/groups/global/AllUsers"
            },
            "Permission": "WRITE"
        }
    ]
}

05 Repeat steps no. 3 and 4 for each S3 bucket that you want to examine available in your AWS account.

Remediation / Resolution

To remove public WRITE access for your S3 buckets, you need to perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Select the S3 bucket that you want to examine and click the Properties tab from the S3 dashboard top right menu:

04 In the Properties panel, click Permissions to expand the bucket Access Control List (ACL) configuration tab and search for the grantee (predefined group) named "Everyone".

05 Uncheck the Upload/Delete (WRITE) permission applied to "Everyone":

or delete the predefined group entirely using the x button available next to the group settings:

06 Click Save to apply the new ACL configuration and remove the bucket public WRITE (UPLOAD/DELETE) access.

07 Repeat steps no. 3 – 6 for each publicly “WRITE” accessible S3 bucket available in your AWS account.

Using AWS CLI

01 Run list-buckets command (OSX/Linux/UNIX) to list all existing S3 buckets available in your account:

aws s3api list-buckets
	--query 'Buckets[*].Name'

02 The command output should return the name of each existing S3 bucket. The following output example returns one S3 bucket named webapp-data-repository:

[
    "webapp-data-repository"
]

03 Run put-bucket-acl command (OSX/Linux/UNIX) using the bucket name as command parameter, to update permissions and remove the public WRITE access for the selected S3 bucket by applying the private predefined ACL (if successful, the command should not return any output):

aws s3api put-bucket-acl
	--bucket webapp-data-repository
	--acl private

04 Repeat step no. 3 for each publicly “WRITE” accessible S3 bucket within your AWS account.

References

AWS Command Line Interface (CLI) Documentation
s3api
list-buckets
get-bucket-acl
put-bucket-acl

S3 Bucket Public 'WRITE' Access

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS Console

Using AWS CLI

References

Related S3 rules