Skip to content

S3 access control lists (ACLs) should not be used to manage user access to buckets #539

Closed
@jchrisfarris

Description

Describe the bug
The proper way to ensure that ACLs are not used to manage object and bucket access is to disable them via the Bucket Owner Enforced setting in S3

Steampipe version (steampipe -v)
v18.0

Plugin version (steampipe plugin list)
Default in SPC
Mod version 0.54.0

To reproduce
An S3 bucket with either of the two settings bucket owner preferred or object writer still allow ACLs to be used. At the time the mod only looks for the presence of any ACLs, not to see if ACLs are disabled.

Expected behavior
The mod should report this finding as non-compliant if the ownership setting is not bucket owner enforced

Additional context
Add any other context about the problem here.

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions