> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # S3 Bucket Should Not Allow FULL_CONTROL Access to Authenticated Users ### More Info: AWS S3 buckets should not be granting FULL\_CONTROL access to authenticated users (i.e. signed AWS accounts or AWS IAM users) in order to prevent unauthorized access. Exposing your S3 buckets to AWS signed accounts or users can lead to data leaks, data loss and unexpected charges for the S3 service. ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the issue of an S3 Bucket allowing FULL\_CONTROL access to Authenticated Users in AWS using the AWS console: 1. Login to your AWS account and go to the S3 console. 2. Select the bucket for which you want to remediate the issue. 3. Click on the "Permissions" tab in the top navigation bar. 4. Under the "Access control list (ACL)" section, locate the "Authenticated Users" group and select it. 5. Click on the "Actions" button and select "Edit bucket policy". 6. In the bucket policy editor, remove the "FULL\_CONTROL" permission from the "Authenticated Users" group. 7. Click on the "Save changes" button to save the updated bucket policy. After following these steps, the S3 bucket will no longer allow FULL\_CONTROL access to Authenticated Users. # To remediate the misconfiguration in AWS, you can follow the below steps using AWS CLI: 1. Open the AWS CLI and run the following command to list all the S3 buckets in your account: ``` aws s3api list-buckets ``` 2. Identify the S3 bucket that is allowing FULL\_CONTROL access to authenticated users. 3. Run the following command to remove the FULL\_CONTROL access for authenticated users: ``` aws s3api put-bucket-acl --bucket --grant-full-control id=uri=http://acs.amazonaws.com/groups/global/AuthenticatedUsers ``` Replace `` with the name of the S3 bucket that you want to remediate. 4. Verify that the FULL\_CONTROL access for authenticated users has been removed by running the following command: ``` aws s3api get-bucket-acl --bucket ``` This command will display the access control list (ACL) for the specified S3 bucket. Verify that the authenticated users no longer have FULL\_CONTROL access. 5. Repeat the above steps for any other S3 buckets that are allowing FULL\_CONTROL access to authenticated users. By following the above steps, you can remediate the misconfiguration in AWS where S3 bucket is allowing FULL\_CONTROL access to authenticated users. To remediate the misconfiguration "S3 Bucket Should Not Allow FULL\_CONTROL Access to Authenticated Users" in AWS using Python, you can follow these steps: 1. First, you need to identify the S3 buckets that have full control access to authenticated users. You can use the AWS SDK for Python (Boto3) to list all the S3 buckets and their access control lists (ACLs). ```python theme={null} import boto3 s3 = boto3.client('s3') # List all the S3 buckets buckets = s3.list_buckets() # Iterate over the buckets and their ACLs for bucket in buckets['Buckets']: bucket_name = bucket['Name'] acl = s3.get_bucket_acl(Bucket=bucket_name) print(f"Bucket {bucket_name} ACL: {acl}") ``` 2. Once you have identified the buckets with full control access to authenticated users, you can update their ACLs to remove the FULL\_CONTROL permission for authenticated users. You can use the `put_bucket_acl` method of the S3 client to update the ACL. ```python theme={null} import boto3 s3 = boto3.client('s3') # Update the ACL for the bucket to remove FULL_CONTROL permission for authenticated users s3.put_bucket_acl( Bucket='my-bucket', GrantFullControl='', GrantRead='', GrantWrite='', GrantReadACP='', GrantWriteACP='', AccessControlPolicy={ 'Grants': [ { 'Grantee': { 'Type': 'Group', 'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' }, 'Permission': 'READ' }, { 'Grantee': { 'Type': 'Group', 'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' }, 'Permission': 'WRITE' }, { 'Grantee': { 'Type': 'Group', 'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' }, 'Permission': 'READ_ACP' }, { 'Grantee': { 'Type': 'Group', 'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers' }, 'Permission': 'WRITE_ACP' } ], 'Owner': { 'DisplayName': 'string', 'ID': 'string' } } ) ``` This will remove the FULL\_CONTROL permission for authenticated users from the ACL of the specified bucket. You can repeat this step for all the buckets that have full control access to authenticated users. ```hcl theme={null} resource "aws_s3_bucket" "this" { bucket = "YOUR_BUCKET_NAME" # replace with your S3 bucket name } # WARNING: This configuration is destructive for the bucket ACL. # It replaces the entire existing ACL with 'private', removing # ALL existing grants (including to other AWS accounts/services). # Review the current ACL before applying: # aws s3api get-bucket-acl --bucket YOUR_BUCKET_NAME --region YOUR_REGION resource "aws_s3_bucket_acl" "this" { bucket = aws_s3_bucket.this.id acl = "private" } ``` Changing the ACL in this way does NOT force replacement of the bucket itself, but it does overwrite all existing ACL grants on that bucket. To verify, `terraform plan` should show an `aws_s3_bucket_acl` resource being created or updated with `acl = "private"`, and no grants to the `AuthenticatedUsers` group. ### Additional Reading: * [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html)