​
More Info:

There should not be any publicly accessible S3 buckets available in your AWS account in order to protect your S3 data from loss and unauthorized access.

​
Risk Level

Critical

​
Address

Security

​
Compliance Standards

CBP, HITRUST, AWSWAF, SOC2, NISTCSF

​
Remediation

​
Using Console

Sure, here are the step-by-step instructions to remediate the S3 bucket misconfiguration in AWS:

  1. Log in to the AWS Management Console and navigate to the S3 service.

  2. Click on the name of the bucket that has the public FULL_CONTROL access.

  3. Click on the “Permissions” tab and then select “Bucket Policy”.

  4. Review the policy to see if there is any statement that grants public FULL_CONTROL access.

  5. If there is any statement that grants public FULL_CONTROL access, remove it from the policy by editing the JSON policy document.

  6. Alternatively, you can also revoke the public FULL_CONTROL access by selecting the “Access Control List” (ACL) tab and then removing the “Everyone” grantee with FULL_CONTROL access.

  7. Once you have made the necessary changes, click on the “Save” button to save the updated policy or ACL.

  8. Finally, test the bucket to ensure that the public FULL_CONTROL access has been remediated.

By following the above steps, you can remediate the S3 bucket misconfiguration to ensure that it does not allow public FULL_CONTROL access.

​
Using CLI

To remediate this misconfiguration, you can follow these steps using AWS CLI:

  1. Open your terminal and install the AWS CLI if you haven’t installed it already.

  2. Run the following command to list all the S3 buckets in your account:

    aws s3api list-buckets

  3. Identify the bucket that has public FULL_CONTROL access.

  4. Run the following command to remove the public FULL_CONTROL access from the bucket:

    aws s3api put-bucket-acl --bucket <bucket-name> --acl private

    Replace <bucket-name> with the name of the bucket that you identified in step 3.

  5. Verify that the public FULL_CONTROL access has been removed by running the following command:

    aws s3api get-bucket-acl --bucket <bucket-name>

    Replace <bucket-name> with the name of the bucket that you identified in step 3. The output should show that there are no grants with the permission “FULL_CONTROL” for “AllUsers” or “AuthenticatedUsers”.

  6. Repeat steps 3-5 for any other buckets that have public FULL_CONTROL access.

By following these steps, you have successfully remediated the misconfiguration of allowing public FULL_CONTROL access to an S3 bucket in AWS.

​
Using Python

To remediate the misconfiguration of an S3 bucket allowing public FULL_CONTROL access, you can follow these steps:

  1. Open the AWS Management Console and navigate to the S3 service.

  2. Select the bucket that you want to remediate.

  3. Click on the “Permissions” tab and then click on the “Access control list (ACL)” option.

  4. Locate the “Grantee” that is set to “Everyone” and has “FULL_CONTROL” permissions.

  5. Remove the “Grantee” by clicking on the “x” icon next to it.

  6. Click on the “Save” button to save the changes.

To automate this process using Python, you can use the AWS SDK for Python (Boto3) and follow these steps:

  1. Install the Boto3 library by running the following command in your terminal:
pip install boto3
  1. Create a new Python file and import the necessary libraries:
import boto3
  1. Create a new S3 client:
s3 = boto3.client('s3')
  1. Retrieve the ACL of the bucket:
bucket_acl = s3.get_bucket_acl(Bucket='your-bucket-name')
  1. Loop through the ACL and remove any grant that has “FULL_CONTROL” permissions for the “AllUsers” group:
for grant in bucket_acl['Grants']:
    if grant['Grantee']['Type'] == 'Group' and grant['Grantee']['URI'] == 'http://acs.amazonaws.com/groups/global/AllUsers' and grant['Permission'] == 'FULL_CONTROL':
        s3.put_bucket_acl(Bucket='your-bucket-name', AccessControlPolicy={'Grants': [g for g in bucket_acl['Grants'] if g != grant], 'Owner': bucket_acl['Owner']})
  1. Run the Python script and check the S3 bucket to confirm that the public FULL_CONTROL access has been removed.

Note: Make sure to replace “your-bucket-name” with the name of your actual S3 bucket.

​
Additional Reading: