lacework-global-132
Ensure the bucket Access Control List (ACL) does not grant 'Everyone' READ_ACP permission [read bucket ACL]
Description
The S3 bucket ACL gives 'Everyone' permission to read the bucket ACL. It is best practice to restrict READ_ACP permission to only principals who require it.
Note: S3 buckets created with the default/recommended AWS settings have ACLs turned off and are therefore compliant with this policy.
Remediation
Perform the following to revoke READ_ACP permission for 'Everyone':
- Sign in to the AWS Management Console.
- Select Services.
- Select S3.
- Select the bucket to change.
- Navigate to Permissions.
- Navigate to Access Control List and select Edit.
- Against Everyone (public access), clear 'Read' under Bucket ACL.
- Select Save changes.
- Repeat steps 4-8 for each bucket requiring updated permissions.