Commit 9c9fed1391
Unregistered key
Layout: unified · split
content/blog/2026-03-03-auditing-aws-s3.org +5 −5
| @@ -184,23 +184,23 @@ prevent it from becoming public if a policy or ACL were changed. | ||
| 184 | 184 | |
| 185 | 185 | * Common Exceptions and False Positives |
| 186 | 186 | |
| 187 | - *Static website hosting*: Buckets used for static website hosting are | |
| 187 | - =Static website hosting=: Buckets used for static website hosting are | |
| 188 | 188 | intentionally public. These will show up with ~TRUE~ overall status and public |
| 189 | 189 | ACLs or policies. Confirm the business purpose with IT and document them as |
| 190 | 190 | accepted exceptions rather than findings. |
| 191 | - *Policy_IsPublic with No Policy*: A ~No Policy~ result in the policy column is not | |
| 191 | - =Policy_IsPublic with No Policy=: A ~No Policy~ result in the policy column is not | |
| 192 | 192 | a finding. It simply means no bucket policy is attached. The overall status |
| 193 | 193 | depends on PAB and ACLs. |
| 194 | - *FALSE-VULNERABLE with FALSE overall status*: This is a configuration weakness | |
| 194 | - =FALSE-VULNERABLE with FALSE overall status=: This is a configuration weakness | |
| 195 | 195 | rather than an active exposure finding. The bucket isn't currently public, but |
| 196 | 196 | PAB is not fully enabled, meaning a future change could expose it. Write this |
| 197 | 197 | up separately from buckets that are actively public, as the risk and |
| 198 | 198 | remediation are different. |
| 199 | - *Cross-account or service-specific policies*: Some bucket policies grant access | |
| 199 | - =Cross-account or service-specific policies=: Some bucket policies grant access | |
| 200 | 200 | to specific AWS accounts or services (e.g., CloudFront, Config, ELB logging). |
| 201 | 201 | AWS may flag these as ~IsPublic~ even though they're not publicly accessible in |
| 202 | 202 | practice. Review the actual bucket policy before raising it as a finding. |
| 203 | - *Region coverage*: If a bucket's region isn't in the ~AWS_REGIONS~ list, the | |
| 203 | - =Region coverage=: If a bucket's region isn't in the ~AWS_REGIONS~ list, the | |
| 204 | 204 | script can't determine its location and will skip it with a warning. Make sure |
| 205 | 205 | the region list in the script covers your organization's full footprint before |
| 206 | 206 | treating the CSV as a complete population. |