Description:
This policy ensures that all S3 buckets have Access Control Lists (ACLs) enabled. This helps to control who has access to the objects in your S3 buckets.

Rationale:
ACLs allow you to specify who has read, write, and/or delete permissions to the objects in your S3 buckets. This can help to protect your data from unauthorized access.

Impact:
If you do not enable ACLs on your S3 buckets, anyone who has the bucket's URL will be able to access the objects in the bucket. This could lead to data breaches or unauthorized access to your sensitive data.

Default Value:
By default, S3 buckets are created with ACLs disabled. You must explicitly enable ACLs for each bucket.

Pre-requisites:

  • You must have an AWS account and be an IAM user with the appropriate permissions to enable ACLs on S3 buckets.


Remediation Steps:

  1. Enable ACLs for each S3 bucket.
  2. Verify that the ACLs are enabled by checking the S3 console or the AWS CLI.


Test Plan:

  1. Identify a subset of S3 buckets that do not have ACLs enabled.
  2. Enable ACLs for the selected S3 buckets.
  3. Verify that the ACLs are enabled by checking the S3 console or the AWS CLI.

Implementation Plan:

AWS CLI:

aws s3api put-bucket-acl --bucket <bucket-name> --acl <acl-string>



AWS GUI:

  1. Go to the S3 console.
  2. Click the name of the bucket that you want to enable ACLs for.
  3. Click Permissions.
  4. Select the Bucket ACL tab.
  5. Click Edit.
  6. In the ACL section, select the Enable checkbox.
  7. Click Save.

Backout Plan:

  1. Disable ACLs for each S3 bucket.
  2. Verify that the ACLs are disabled by checking the S3 console or the AWS CLI.

Note:

  • This policy applies to all regions and accounts.
  • You can use the AWS CLI or the AWS SDKs to automate the process of enabling and disabling ACLs on S3 buckets.

Reference:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html