​
More Info:

AWS S3 buckets should not allow READ_ACP access to AWS authenticated users using ACLs in order to protect against unauthorized access.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

CBP, PCIDSS, NIST

​
Remediation

​
Using Console

Here are the step by step instructions to remediate the S3 Bucket misconfiguration for AWS using AWS Console:

  1. Log in to your AWS Management Console.

  2. Go to the S3 service dashboard.

  3. Select the bucket that you want to remediate.

  4. Click on the “Permissions” tab.

  5. Scroll down to the “Access Control List (ACL)” section.

  6. Click on the “Edit” button next to the “Authenticated Users” group.

  7. Uncheck the “Read” permission for the “Access Control Policy (ACP)“.

  8. Click on the “Save” button to apply the changes.

  9. Verify that the “Read” permission for the “Access Control Policy (ACP)” is no longer enabled for the “Authenticated Users” group.

  10. Repeat the above steps for any other S3 buckets that may have this misconfiguration.

By following these steps, you will have successfully remediated the S3 Bucket misconfiguration of not allowing READ_ACP access for authenticated users in AWS.

​
Using CLI

To remediate the issue of S3 bucket allowing READ_ACP access for authenticated users in AWS using AWS CLI, follow these steps:

  1. Open the AWS CLI on your local machine and run the following command to list all the S3 buckets in your AWS account:
aws s3 ls

  1. Identify the S3 bucket that has READ_ACP access for authenticated users.

  2. Run the following command to revoke READ_ACP access for authenticated users:

aws s3api put-bucket-acl --bucket <bucket-name> --grant-read-acp uri=http://acs.amazonaws.com/groups/global/AuthenticatedUsers --acl private

Note: Replace <bucket-name> with the name of the S3 bucket that needs to be remediated.

  1. Verify that the remediation is successful by running the following command:
aws s3api get-bucket-acl --bucket <bucket-name>

Note: Replace <bucket-name> with the name of the S3 bucket that was remediated.

This command should return the updated ACL of the S3 bucket, which should now have private access for READ_ACP.

​
Using Python

To remediate the misconfiguration “S3 Bucket Should Not Allow READ_ACP Access For Authenticated Users” in AWS using Python, you can follow the below steps:

  1. Open the AWS Management Console and navigate to the S3 service.

  2. Select the S3 bucket that you want to remediate.

  3. Click on the Permissions tab and select the Access control list (ACL) option.

  4. Under the “Grantee” column, search for the “Authenticated Users” group.

  5. In the “Permission” column, deselect the “READ_ACP” option for the “Authenticated Users” group.

  6. Click on the Save button to apply the changes.

To automate this process using Python, you can use the boto3 library, which is the AWS SDK for Python. Below is the code snippet to remediate the misconfiguration using Python:

import boto3

s3 = boto3.resource('s3')

bucket_name = 'your_bucket_name'

bucket_acl = s3.BucketAcl(bucket_name)

# Revoke READ_ACP permission for Authenticated Users group
response = bucket_acl.put(
    AccessControlPolicy={
        'Grants': [
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                },
                'Permission': 'WRITE_ACP'
            }
        ],
        'Owner': {
            'DisplayName': 'Your Name',
            'ID': 'your_aws_account_id'
        }
    }
)

print(response)

Note: Replace the bucket_name variable with the name of your S3 bucket. Also, make sure that you have the necessary AWS credentials configured to run this script.

​
Additional Reading: