S3 access control lists (ACLs) should not be used to manage user access to buckets #539
Closed
Description
Describe the bug
The proper way to ensure that ACLs are not used to manage object and bucket access is to disable them via the Bucket Owner Enforced
setting in S3
Steampipe version (steampipe -v
)
v18.0
Plugin version (steampipe plugin list
)
Default in SPC
Mod version 0.54.0
To reproduce
An S3 bucket with either of the two settings bucket owner preferred
or object writer
still allow ACLs to be used. At the time the mod only looks for the presence of any ACLs, not to see if ACLs are disabled.
Expected behavior
The mod should report this finding as non-compliant if the ownership setting is not bucket owner enforced
Additional context
Add any other context about the problem here.