S3 bucket policy does not allow cross-account access
s3_bucket_cross_account_access
Amazon S3 bucket policies are analyzed for statements that grant cross-account access.
Any policy that names principals outside the owning account (other account IDs or Principal: "*") is treated as cross-account; absence of a policy implies no cross-account grants.
Risk
Cross-account grants can let external principals read, write, or administer the bucket, impacting:
- Confidentiality: unauthorized object access/exfiltration
- Integrity: object tampering, policy or encryption changes
- Availability: deletions, versioning changes, or lockouts causing data loss and downtime
prowler aws --checks s3_bucket_cross_account_access
Recommendation
Enforce least privilege: limit bucket policy Principal to your account or approved org IDs with fixed values; avoid wildcards.
Use role-based cross-account access with scoped permissions when needed. Add defense-in-depth conditions (private networks, TLS), and periodically review for unintended external access.
Remediation
aws s3api delete-bucket-policy --bucket <example_resource_name>
- In the AWS console, go to S3 > Buckets > select the bucket
- Open the Permissions tab > Bucket policy
- Click Delete bucket policy (or remove all statements) and Save
- If a policy is required, ensure all statements only use your account as Principal (arn:aws:iam::<YOUR_ACCOUNT_ID>:root); remove any other accounts or "*"
Source Code
Resource Type
AwsS3Bucket