Description:

This check verifies that Utho Cloud Object Storage buckets are not configured for public access. Buckets should only be accessible to authorized users or applications. Public access can expose sensitive data to unauthorized users and increase the risk of data leakage.


Rationale:

Publicly accessible object storage can expose confidential or sensitive information.

This check helps:

  • Prevent unauthorized access to stored data.

  • Reduce the risk of accidental data exposure.

  • Enforce least-privilege access.

  • Support security and compliance requirements.


Impact:

  • Reduces the risk of data leakage.

  • Prevents anonymous users from accessing bucket contents.

  • Improves protection of stored objects.

  • Public applications or users may lose access if they legitimately depend on anonymous bucket access.


Default Value:

Utho Cloud Object Storage buckets should not be publicly accessible. A bucket is considered non-compliant if its access configuration allows anonymous or public read access.


Pre-requisites:

  • Utho Cloud account.

  • Permissions to view Object Storage buckets and access policies.

  • Access to the Utho Cloud Console or Utho API.

  • Object Storage buckets configured in the account.


Test Plan:

  1. Sign in to the Utho Cloud Console.

  2. Navigate to Object Storage.

  3. Select each bucket.

  4. Review the bucket's access or permission configuration.

  5. Verify that the bucket does not allow public or anonymous access.

       


Using the Utho API:

List all Object Storage buckets and inspect their access configuration or bucket policy.

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/object-storage/buckets

For each bucket, retrieve its access configuration or policy:

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/object-storage/buckets/<BUCKET_ID>


Implementation Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to Object Storage.

  1. Select the non-compliant bucket.

            

  1. Click on Access control

  2. Disable public or anonymous access.

  3. In the Manage Access control, change the access level control to private.

         

  1. Save the configuration.


Using the Utho API:

Update the bucket access configuration or policy to remove public access and restrict permissions to authorized users or applications.

curl -s -X PUT \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"public":false}' \
https://api.utho.com/v2/object-storage/buckets/<BUCKET_ID>

Backout Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to Object Storage.

  3. Select the modified bucket.

  4. Restore the previous access policy if legitimate public access is required.

  5. Verify application and object access.

  6. Replace broad public access with a restricted policy where possible.


References:

  • Utho Cloud Object Storage documentation.

  • Utho Cloud Object Storage API documentation.

  • Utho Cloud API Token documentation.