S3 Bucket Should Not Allow READ_ACP Access For Authenticated Users

More Info:

AWS S3 buckets should not allow READ_ACP access to AWS authenticated users using ACLs in order to protect against unauthorized access.

Risk Level

Medium

Address

Security

Compliance Standards

CBP, PCIDSS, NIST

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the issue of S3 bucket allowing READ_ACP access for authenticated users in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine and run the following command to list all the S3 buckets in your AWS account:

aws s3 ls

Identify the S3 bucket that has READ_ACP access for authenticated users.
Run the following command to revoke READ_ACP access for authenticated users:

aws s3api put-bucket-acl --bucket <bucket-name> --grant-read-acp uri=http://acs.amazonaws.com/groups/global/AuthenticatedUsers --acl private

Note: Replace <bucket-name> with the name of the S3 bucket that needs to be remediated.

Verify that the remediation is successful by running the following command:

aws s3api get-bucket-acl --bucket <bucket-name>

Note: Replace <bucket-name> with the name of the S3 bucket that was remediated.This command should return the updated ACL of the S3 bucket, which should now have private access for READ_ACP.

Using Python

To remediate the misconfiguration “S3 Bucket Should Not Allow READ_ACP Access For Authenticated Users” in AWS using Python, you can follow the below steps:

Open the AWS Management Console and navigate to the S3 service.
Select the S3 bucket that you want to remediate.
Click on the Permissions tab and select the Access control list (ACL) option.
Under the “Grantee” column, search for the “Authenticated Users” group.
In the “Permission” column, deselect the “READ_ACP” option for the “Authenticated Users” group.
Click on the Save button to apply the changes.

To automate this process using Python, you can use the boto3 library, which is the AWS SDK for Python. Below is the code snippet to remediate the misconfiguration using Python:

import boto3

s3 = boto3.resource('s3')

bucket_name = 'your_bucket_name'

bucket_acl = s3.BucketAcl(bucket_name)

# Revoke READ_ACP permission for Authenticated Users group
response = bucket_acl.put(
    AccessControlPolicy={
        'Grants': [
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                },
                'Permission': 'WRITE_ACP'
            }
        ],
        'Owner': {
            'DisplayName': 'Your Name',
            'ID': 'your_aws_account_id'
        }
    }
)

print(response)

Note: Replace the bucket_name variable with the name of your S3 bucket. Also, make sure that you have the necessary AWS credentials configured to run this script.

Additional Reading:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

S3 Bucket Should Not Allow READ_ACP Access For Authenticated Users

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: