{
  "Provider": "aws",
  "CheckID": "s3_bucket_public_list_acl",
  "CheckTitle": "Ensure there are no S3 buckets listable by Everyone or Any AWS customer.",
  "CheckType": [
    "Data Protection"
  ],
  "ServiceName": "s3",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:s3:::bucket_name",
  "Severity": "critical",
  "ResourceType": "AwsS3Bucket",
  "Description": "Ensure there are no S3 buckets listable by Everyone or Any AWS customer.",
  "Risk": "Even if you enable all possible bucket ACL options available in the Amazon S3 console the ACL alone does not allow everyone to download objects from your bucket. Depending on which option you select any user could perform some actions.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "aws s3api put-bucket-acl --bucket <bucket_name> --acl private",
      "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html",
      "Other": "",
      "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html"
    },
    "Recommendation": {
      "Text": "You can enable block public access settings only for access points, buckets and AWS accounts. Amazon S3 does not support block public access settings on a per-object basis. When you apply block public access settings to an account; the settings apply to all AWS Regions globally. The settings might not take effect in all Regions immediately or simultaneously, but they eventually propagate to all Regions.",
      "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
    }
  },
  "Categories": [
    "internet-exposed"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
