S3 bucket ACL should not grant WRITE_ACP to a predefined group

What it checks

S3 bucket ACL: WRITE_ACP is granted to the AllUsers or AuthenticatedUsers group — an ACL S3 itself classes as public.

Where it applies

Terraform: aws_s3_bucket_acl

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Remove the WRITE_ACP grant to the AllUsers / AuthenticatedUsers group. If cross-account access is required, use a scoped aws_s3_bucket_policy with named principals instead of an ACL grant.

Frameworks

• SOC 2 CC6.3
• NIST 800-53 rev5 AC-3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules