S3 bucket should not grant read to any authenticated AWS user

What it checks

S3 bucket should not grant read to any authenticated AWS user

Where it applies

Terraform: aws_s3_bucket, aws_s3_bucket_acl

CloudFormation: AWS::S3::Bucket

How to fix it

1. Set acl = "private" (or remove the acl attribute) and delete any grant to http://acs.amazonaws.com/groups/global/AuthenticatedUsers. Grant cross-account read via a scoped bucket policy with named account ARNs instead.

Frameworks

• AWS FSBP S3.2
• SOC 2 CC6.3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules