lacework-global-135
Ensure the bucket ACL does not grant AWS users READ permission [list S3 objects]
Description
The S3 bucket ACL gives any authenticated AWS user permission to list objects, which allows any authenticated AWS user to list the bucket contents. It is best practice to restrict READ permission to only principals who require it.
Note: S3 buckets created with the default/recommended AWS settings have ACLs disabled and will therefore be compliant with this policy.
Remediation
Perform the following to revoke READ permission for all AWS users:
Sign in to the AWS Management Console
Select Services
Select S3
Select the bucket to change
Navigate to Permissions
Navigate to Access Control List and select Edit
Against Authenticated users group (anyone with an AWS account), uncheck 'List' under Objects
Select Save changes
Repeat steps 4-8 for each bucket requiring updated permissions