S3 Bucket Should Not Allow FULL_CONTROL Access to Authenticated Users

More Info:

AWS S3 buckets should not be granting FULL_CONTROL access to authenticated users (i.e. signed AWS accounts or AWS IAM users) in order to prevent unauthorized access. Exposing your S3 buckets to AWS signed accounts or users can lead to data leaks, data loss and unexpected charges for the S3 service.

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the issue of an S3 Bucket allowing FULL_CONTROL access to Authenticated Users in AWS using the AWS console:

1. Login to your AWS account and go to the S3 console.
2. Select the bucket for which you want to remediate the issue.
3. Click on the “Permissions” tab in the top navigation bar.
4. Under the “Access control list (ACL)” section, locate the “Authenticated Users” group and select it.
5. Click on the “Actions” button and select “Edit bucket policy”.
6. In the bucket policy editor, remove the “FULL_CONTROL” permission from the “Authenticated Users” group.
7. Click on the “Save changes” button to save the updated bucket policy.

After following these steps, the S3 bucket will no longer allow FULL_CONTROL access to Authenticated Users.

Using CLI

To remediate the misconfiguration in AWS, you can follow the below steps using AWS CLI:

1. Open the AWS CLI and run the following command to list all the S3 buckets in your account:

   aws s3api list-buckets
   

2. Identify the S3 bucket that is allowing FULL_CONTROL access to authenticated users.

3. Run the following command to remove the FULL_CONTROL access for authenticated users:

   aws s3api put-bucket-acl --bucket <bucket-name> --grant-full-control id=uri=http://acs.amazonaws.com/groups/global/AuthenticatedUsers
   

   Replace <bucket-name> with the name of the S3 bucket that you want to remediate.

4. Verify that the FULL_CONTROL access for authenticated users has been removed by running the following command:

   aws s3api get-bucket-acl --bucket <bucket-name>
   

   This command will display the access control list (ACL) for the specified S3 bucket. Verify that the authenticated users no longer have FULL_CONTROL access.

5. Repeat the above steps for any other S3 buckets that are allowing FULL_CONTROL access to authenticated users.

By following the above steps, you can remediate the misconfiguration in AWS where S3 bucket is allowing FULL_CONTROL access to authenticated users.

Using Python

To remediate the misconfiguration “S3 Bucket Should Not Allow FULL_CONTROL Access to Authenticated Users” in AWS using Python, you can follow these steps:

1. First, you need to identify the S3 buckets that have full control access to authenticated users. You can use the AWS SDK for Python (Boto3) to list all the S3 buckets and their access control lists (ACLs).

import boto3

s3 = boto3.client('s3')

# List all the S3 buckets
buckets = s3.list_buckets()

# Iterate over the buckets and their ACLs
for bucket in buckets['Buckets']:
    bucket_name = bucket['Name']
    acl = s3.get_bucket_acl(Bucket=bucket_name)
    print(f"Bucket {bucket_name} ACL: {acl}")

2. Once you have identified the buckets with full control access to authenticated users, you can update their ACLs to remove the FULL_CONTROL permission for authenticated users. You can use the put_bucket_acl method of the S3 client to update the ACL.

import boto3

s3 = boto3.client('s3')

# Update the ACL for the bucket to remove FULL_CONTROL permission for authenticated users
s3.put_bucket_acl(
    Bucket='my-bucket',
    GrantFullControl='',
    GrantRead='',
    GrantWrite='',
    GrantReadACP='',
    GrantWriteACP='',
    AccessControlPolicy={
        'Grants': [
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                },
                'Permission': 'READ'
            },
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                },
                'Permission': 'WRITE'
            },
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                },
                'Permission': 'READ_ACP'
            },
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                },
                'Permission': 'WRITE_ACP'
            }
        ],
        'Owner': {
            'DisplayName': 'string',
            'ID': 'string'
        }
    }
)

This will remove the FULL_CONTROL permission for authenticated users from the ACL of the specified bucket. You can repeat this step for all the buckets that have full control access to authenticated users.

Using Terraform

resource "aws_s3_bucket" "this" {
  bucket = "YOUR_BUCKET_NAME" # replace with your S3 bucket name
}

# WARNING: This configuration is destructive for the bucket ACL.
# It replaces the entire existing ACL with 'private', removing
# ALL existing grants (including to other AWS accounts/services).
# Review the current ACL before applying:
#   aws s3api get-bucket-acl --bucket YOUR_BUCKET_NAME --region YOUR_REGION
resource "aws_s3_bucket_acl" "this" {
  bucket = aws_s3_bucket.this.id
  acl    = "private"
}

Changing the ACL in this way does NOT force replacement of the bucket itself, but it does overwrite all existing ACL grants on that bucket.

To verify, terraform plan should show an aws_s3_bucket_acl resource being created or updated with acl = "private", and no grants to the AuthenticatedUsers group.

Additional Reading:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html