S3 bucket ACL does not grant write access to Everyone or any AWS customer
s3_bucket_public_write_acl
Amazon S3 buckets are assessed for ACL grants that allow public write access to AllUsers or AuthenticatedUsers via WRITE, WRITE_ACP, or FULL_CONTROL. Effective Block Public Access at account or bucket level (ignore_public_acls, restrict_public_buckets) is considered.
Risk
Public or cross-account writes enable object tampering, log poisoning, and ACL changes via WRITE_ACP, undermining integrity and causing covert data exposure. Attackers can plant malware, deface content, and inflate costs, impacting availability through overwrites or prefix flooding.
prowler aws --checks s3_bucket_public_write_acl
prowler aws --checks s3_bucket_public_write_acl --fixer
Recommendation
Apply least privilege to S3 writes. Enable account-level Block Public Access and use Object Ownership to disable ACLs. Grant write only to fixed principals via bucket policies with tight conditions (e.g., org IDs, VPC endpoints). Add versioning and monitoring for defense-in-depth.
Remediation
aws s3api put-bucket-acl --bucket <bucket_name> --acl private
- In the AWS Console, go to S3 > Buckets and open <bucket_name>
- Go to the Permissions tab > Access control list (ACL) > Edit
- Remove any grantee "Everyone (public access)" or "Any AWS account" with Write, Write ACL, or Full control
- Ensure only the bucket owner retains Full control
- Click Save changes
Source Code
Resource Type
AwsS3Bucket