All checks
High
S3 general purpose bucket policies should restrict access to other AWS accounts
Flags S3 bucket policies that grant overly permissive access to other AWS accounts.
- service
- S3
- severity
- High
- scope
- evaluated once per account
How to fix it
Leave no statement in the bucket policy that allows s3:DeleteBucketPolicy, s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutEncryptionConfiguration or s3:PutObjectAcl to a principal in another AWS account.
In the console
S3 → the bucket → Permissions → Bucket policy
With the AWS CLI
aws s3api put-bucket-policy --bucket <bucket> --policy file://bucket-policy.jsonSee which of your accounts this check is failing on.
Book a demo