> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 allows authenticated full control remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the issue of an S3 Bucket allowing FULL\_CONTROL access to Authenticated Users in AWS using the AWS console:

        1. Login to your AWS account and go to the S3 console.
        2. Select the bucket for which you want to remediate the issue.
        3. Click on the "Permissions" tab in the top navigation bar.
        4. Under the "Access control list (ACL)" section, locate the "Authenticated Users" group and select it.
        5. Click on the "Actions" button and select "Edit bucket policy".
        6. In the bucket policy editor, remove the "FULL\_CONTROL" permission from the "Authenticated Users" group.
        7. Click on the "Save changes" button to save the updated bucket policy.

        After following these steps, the S3 bucket will no longer allow FULL\_CONTROL access to Authenticated Users.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration in AWS, you can follow the below steps using AWS CLI:

        1. Open the AWS CLI and run the following command to list all the S3 buckets in your account:

           ```
           aws s3api list-buckets
           ```

        2. Identify the S3 bucket that is allowing FULL\_CONTROL access to authenticated users.

        3. Run the following command to remove the FULL\_CONTROL access for authenticated users:

           ```
           aws s3api put-bucket-acl --bucket <bucket-name> --grant-full-control id=uri=http://acs.amazonaws.com/groups/global/AuthenticatedUsers
           ```

           Replace `<bucket-name>` with the name of the S3 bucket that you want to remediate.

        4. Verify that the FULL\_CONTROL access for authenticated users has been removed by running the following command:

           ```
           aws s3api get-bucket-acl --bucket <bucket-name>
           ```

           This command will display the access control list (ACL) for the specified S3 bucket. Verify that the authenticated users no longer have FULL\_CONTROL access.

        5. Repeat the above steps for any other S3 buckets that are allowing FULL\_CONTROL access to authenticated users.

        By following the above steps, you can remediate the misconfiguration in AWS where S3 bucket is allowing FULL\_CONTROL access to authenticated users.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "S3 Bucket Should Not Allow FULL\_CONTROL Access to Authenticated Users" in AWS using Python, you can follow these steps:

        1. First, you need to identify the S3 buckets that have full control access to authenticated users. You can use the AWS SDK for Python (Boto3) to list all the S3 buckets and their access control lists (ACLs).

        ```python theme={null}
        import boto3

        s3 = boto3.client('s3')

        # List all the S3 buckets
        buckets = s3.list_buckets()

        # Iterate over the buckets and their ACLs
        for bucket in buckets['Buckets']:
            bucket_name = bucket['Name']
            acl = s3.get_bucket_acl(Bucket=bucket_name)
            print(f"Bucket {bucket_name} ACL: {acl}")
        ```

        2. Once you have identified the buckets with full control access to authenticated users, you can update their ACLs to remove the FULL\_CONTROL permission for authenticated users. You can use the `put_bucket_acl` method of the S3 client to update the ACL.

        ```python theme={null}
        import boto3

        s3 = boto3.client('s3')

        # Update the ACL for the bucket to remove FULL_CONTROL permission for authenticated users
        s3.put_bucket_acl(
            Bucket='my-bucket',
            GrantFullControl='',
            GrantRead='',
            GrantWrite='',
            GrantReadACP='',
            GrantWriteACP='',
            AccessControlPolicy={
                'Grants': [
                    {
                        'Grantee': {
                            'Type': 'Group',
                            'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                        },
                        'Permission': 'READ'
                    },
                    {
                        'Grantee': {
                            'Type': 'Group',
                            'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                        },
                        'Permission': 'WRITE'
                    },
                    {
                        'Grantee': {
                            'Type': 'Group',
                            'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                        },
                        'Permission': 'READ_ACP'
                    },
                    {
                        'Grantee': {
                            'Type': 'Group',
                            'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                        },
                        'Permission': 'WRITE_ACP'
                    }
                ],
                'Owner': {
                    'DisplayName': 'string',
                    'ID': 'string'
                }
            }
        )
        ```

        This will remove the FULL\_CONTROL permission for authenticated users from the ACL of the specified bucket. You can repeat this step for all the buckets that have full control access to authenticated users.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_s3_bucket" "this" {
          bucket = "YOUR_BUCKET_NAME" # replace with your S3 bucket name
        }

        # WARNING: This configuration is destructive for the bucket ACL.
        # It replaces the entire existing ACL with 'private', removing
        # ALL existing grants (including to other AWS accounts/services).
        # Review the current ACL before applying:
        #   aws s3api get-bucket-acl --bucket YOUR_BUCKET_NAME --region YOUR_REGION
        resource "aws_s3_bucket_acl" "this" {
          bucket = aws_s3_bucket.this.id
          acl    = "private"
        }
        ```

        Changing the ACL in this way does NOT force replacement of the bucket itself, but it does overwrite all existing ACL grants on that bucket.

        To verify, `terraform plan` should show an `aws_s3_bucket_acl` resource being created or updated with `acl = "private"`, and no grants to the `AuthenticatedUsers` group.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>