Description

This detector identifies AWS S3 buckets that have public access permissions through their bucket ACLs (Access Control Lists). Public bucket access can expose sensitive data to unauthorized users and represents a significant security risk as it could allow anyone on the internet to access, and depending on permissions, modify or delete bucket contents.

Detection Strategy

• Scans all S3 buckets in the AWS account

• For each bucket, examines the bucket's ACL (Access Control List) grants

• Reports a vulnerability if any ACL grant allows public access through permissions like READ, WRITE, READ_ACP, WRITE_ACP, or FULL_CONTROL

• Each vulnerability includes the specific bucket name and the problematic permission that enables public access