S3 bucket is not publicly listable by Everyone or any authenticated AWS user
s3_bucket_public_list_acl
Amazon S3 buckets are evaluated for public listing via ACLs. Grants of READ, READ_ACP, or FULL_CONTROL to the AllUsers or AuthenticatedUsers groups are identified. Effective Block Public Access at account or bucket level (notably IgnorePublicAcls and RestrictPublicBuckets) is considered in the evaluation.
Risk
Public listability reveals object names, counts, and structure, enabling reconnaissance and targeted scraping. READ_ACP exposes permission details for further abuse. With FULL_CONTROL, attackers could alter ACLs and disrupt access, undermining confidentiality and risking integrity and availability.
prowler aws --checks s3_bucket_public_list_acl
prowler aws --checks s3_bucket_public_list_acl --fixer
Recommendation
Enable account-level S3 Block Public Access (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets).
- Remove ACL grants to
AllUsers/AuthenticatedUsers; apply least privilege with IAM/bucket policies. - Favor private patterns (VPC endpoints, CloudFront OAC, presigned URLs) and disable ACLs via Object Ownership.
Remediation
aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true
- In the AWS Console, go to S3 and open the bucket
- Select the Permissions tab
- Click Edit under Block public access (bucket settings)
- Enable:
- Ignore public ACLs (bucket and objects)
- Restrict public buckets
- Click Save
Source Code
Resource Type
AwsS3Bucket