lacework-global-133
Ensure the bucket Access Control List (ACL) does not grant 'Everyone' WRITE_ACP permission [modify bucket ACL]
Description
The S3 bucket ACL gives 'Everyone' permission to write [or re-write] the bucket ACL. It is best practice to restrict WRITE_ACP permission to only principals who require it.
Note: S3 buckets created with the default/recommended AWS settings have ACLs turned off and are therefore compliant with this policy.
Remediation
Perform the following to revoke WRITE_ACP permission for 'Everyone':
- Sign in to the AWS Management Console.
- Select Services.
- Select S3.
- Select the bucket to change.
- Navigate to Permissions.
- Navigate to Access Control List and select Edit.
- Against Everyone (public access), clear 'Write' under Bucket ACL.
- Select Save changes.
- Repeat steps 4-8 for each bucket requiring updated permissions.