s3-bucket-public-read-prohibited
Checks if your Amazon S3 buckets do not allow public read access. The rule checks the Block Public Access settings, the bucket policy, and the bucket access control list (ACL).
The rule is compliant when both of the following are true:
The Block Public Access setting restricts public policies or the bucket policy does not allow public read access.
The Block Public Access setting restricts public ACLs or the bucket ACL does not allow public read access.
The rule is noncompliant when:
If the Block Public Access setting does not restrict public policies, AWS Config evaluates whether the policy allows public read access. If the policy allows public read access, the rule is noncompliant.
If the Block Public Access setting does not restrict public bucket ACLs, AWS Config evaluates whether the bucket ACL allows public read access. If the bucket ACL allows public read access, the rule is noncompliant.
Note
To be considered non-public, an S3 bucket policy must grant access only to fixed values. This means a policy is NON_COMPLIANT if it grants access to a wildcard or the following IAM policy element: Variables. A fixed value containing a wildcard can still be COMPLIANT.
Note
If a single value in an S3 bucket policy (for example, one Resource or Condition value) contains more than five IAM policy variables, the rule can't evaluate that policy and returns NON_COMPLIANT, even if the policy would otherwise be compliant. To get an accurate evaluation, split any value that contains more than five policy variables so that each value contains five or fewer.
Identifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
Resource Types: AWS::S3::Bucket
Trigger type: Configuration changes and Periodic
AWS Region: All supported AWS regions
Parameters:
- None
AWS CloudFormation template
To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.
