Commit 8b71bdf249
Unregistered key
Layout: unified · split
content/blog/2026-03-03-auditing-aws-s3.org +5 −5
| @@ -78,7 +78,7 @@ The reverse is also true. A bucket with no public policy and no public ACLs is | |||
| 78 | still at risk if PAB is missing or incomplete, because nothing is in place to | 78 | still at risk if PAB is missing or incomplete, because nothing is in place to |
| 79 | prevent a future policy or ACL change from exposing it. | 79 | prevent a future policy or ACL change from exposing it. |
| 80 | 80 | ||
| 81 | * What the Script Does | 81 | M* What the Script Does |
| 82 | 82 | ||
| 83 | The script lists every bucket in the account, determines each bucket's region, | 83 | The script lists every bucket in the account, determines each bucket's region, |
| 84 | runs all three checks against it, and appends the results to a CSV file. | 84 | runs all three checks against it, and appends the results to a CSV file. |
| @@ -166,14 +166,14 @@ c67fa6bd-2fd5-4bc5-825d-587fb535bf2e,eu-west-1,TRUE,No Policy,FALSE,FALSE,"FALSE | |||
| 166 | 166 | ||
| 167 | Here's how to read each column: | 167 | Here's how to read each column: |
| 168 | 168 | ||
| 169 | - *PAB_FullyRestricted*: ~TRUE~ means all four PAB flags are enabled at the bucket | 169 | - =PAB_FullyRestricted=: ~TRUE~ means all four PAB flags are enabled at the bucket |
| 170 | level. ~FALSE-VULNERABLE~ means PAB exists but is incomplete. ~CRITICAL-MISSING~ | 170 | level. ~FALSE-VULNERABLE~ means PAB exists but is incomplete. ~CRITICAL-MISSING~ |
| 171 | means no PAB configuration exists at all. | 171 | means no PAB configuration exists at all. |
| 172 | - *Policy_IsPublic*: ~true~ means AWS has determined the bucket policy grants public | 172 | - =Policy_IsPublic=: ~true~ means AWS has determined the bucket policy grants public |
| 173 | access. ~false~ means it doesn't. ~No Policy~ means no bucket policy is attached. | 173 | access. ~false~ means it doesn't. ~No Policy~ means no bucket policy is attached. |
| 174 | - *ACL_AllUsersRead / ACL_AllUsersWrite*: ~TRUE~ means the bucket has an ACL | 174 | - =ACL_AllUsersRead= / =ACL_AllUsersWrite=: ~TRUE~ means the bucket has an ACL |
| 175 | granting that permission to the public internet. ~FALSE~ means it doesn't. | 175 | granting that permission to the public internet. ~FALSE~ means it doesn't. |
| 176 | - *OverallPublicStatus*: ~FALSE~ means the bucket is not publicly accessible based | 176 | - =OverallPublicStatus=: ~FALSE~ means the bucket is not publicly accessible based |
| 177 | on all three checks. ~TRUE~ values include the specific reason (e.g., ~TRUE - ACL | 177 | on all three checks. ~TRUE~ values include the specific reason (e.g., ~TRUE - ACL |
| 178 | Read~, ~TRUE - Policy~, ~TRUE - PAB Missing (CRITICAL)~). | 178 | Read~, ~TRUE - Policy~, ~TRUE - PAB Missing (CRITICAL)~). |
| 179 | 179 | ||