1. Log in to the AWS Management Console and navigate to the S3 service.
2. Click on the name of the bucket that has the public FULL_CONTROL access.
3. Click on the “Permissions” tab and then select “Bucket Policy”.
4. Review the policy to see if there is any statement that grants public FULL_CONTROL access.
5. If there is any statement that grants public FULL_CONTROL access, remove it from the policy by editing the JSON policy document.
6. Alternatively, you can also revoke the public FULL_CONTROL access by selecting the “Access Control List” (ACL) tab and then removing the “Everyone” grantee with FULL_CONTROL access.
7. Once you have made the necessary changes, click on the “Save” button to save the updated policy or ACL.
8. Finally, test the bucket to ensure that the public FULL_CONTROL access has been remediated.

​

1. Open your terminal and install the AWS CLI if you haven’t installed it already.
2. Run the following command to list all the S3 buckets in your account:
   Copy

   Ask AI

   aws s3api list-buckets
   

3. Identify the bucket that has public FULL_CONTROL access.
4. Run the following command to remove the public FULL_CONTROL access from the bucket:
   Copy

   Ask AI

   aws s3api put-bucket-acl --bucket <bucket-name> --acl private
   

   Replace <bucket-name> with the name of the bucket that you identified in step 3.
5. Verify that the public FULL_CONTROL access has been removed by running the following command:
   Copy

   Ask AI

   aws s3api get-bucket-acl --bucket <bucket-name>
   

   Replace <bucket-name> with the name of the bucket that you identified in step 3. The output should show that there are no grants with the permission “FULL_CONTROL” for “AllUsers” or “AuthenticatedUsers”.
6. Repeat steps 3-5 for any other buckets that have public FULL_CONTROL access.

1. Open the AWS Management Console and navigate to the S3 service.
2. Select the bucket that you want to remediate.
3. Click on the “Permissions” tab and then click on the “Access control list (ACL)” option.
4. Locate the “Grantee” that is set to “Everyone” and has “FULL_CONTROL” permissions.
5. Remove the “Grantee” by clicking on the “x” icon next to it.
6. Click on the “Save” button to save the changes.

1. Install the Boto3 library by running the following command in your terminal:

pip install boto3

2. Create a new Python file and import the necessary libraries:

import boto3

3. Create a new S3 client:

s3 = boto3.client('s3')

4. Retrieve the ACL of the bucket:

bucket_acl = s3.get_bucket_acl(Bucket='your-bucket-name')

5. Loop through the ACL and remove any grant that has “FULL_CONTROL” permissions for the “AllUsers” group:

for grant in bucket_acl['Grants']:
    if grant['Grantee']['Type'] == 'Group' and grant['Grantee']['URI'] == 'http://acs.amazonaws.com/groups/global/AllUsers' and grant['Permission'] == 'FULL_CONTROL':
        s3.put_bucket_acl(Bucket='your-bucket-name', AccessControlPolicy={'Grants': [g for g in bucket_acl['Grants'] if g != grant], 'Owner': bucket_acl['Owner']})

6. Run the Python script and check the S3 bucket to confirm that the public FULL_CONTROL access has been removed.