Description

Ensure every Object Storage bucket has its visibility set to Private, so that objects can only be read by authenticated users with the right IAM permissions or through pre-authenticated requests. Public visibility should only be used for content that is intentionally meant for everyone.

Rationale

A public bucket lets anyone on the internet list and download its objects without signing in. Sensitive files placed in a public bucket by mistake can be found and copied within hours. Keeping buckets private and sharing specific objects with time-limited pre-authenticated requests prevents unintended data exposure.

Impact

  • Objects can only be accessed by authorized users

  • Prevents accidental exposure of sensitive data

  • Public websites or apps using the bucket need pre-authenticated requests or another solution

Default Value

By default, new buckets are created with Private visibility.

Pre-Requisites

  • Permission to manage buckets in the compartment

  • A list of buckets that must stay public, with a documented reason

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.

  3. Select the Bucket information tab and check the Visibility value.

  4. If it shows Public without a documented reason, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.

  3. Select Edit visibility.

  4. Select Private and select Save changes.

  5. For users or apps that need access, use IAM policies or create pre-authenticated requests with an expiry date.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.

  3. Select Edit visibility, select Public, and select Save changes.

Reference