Evaluates whether the Bucket ACL of each Object Storage Service (OSS) bucket is set to Private or the bucket policy allows access only from specified IP addresses. If either condition is met, the evaluation result is Compliant.
Scenarios
Use this rule to enforce the principle of least privilege (PoLP) on OSS bucket policies and reduce security risks caused by excessive permissions.
Risk level
Default risk level: low.
You can change the risk level based on your business requirements when you apply this rule.
Compliance evaluation logic
- If the Bucket ACL of an OSS bucket is set to Private or the bucket policy allows access only from specified IP addresses, the evaluation result is Compliant.
- If the Bucket ACL of an OSS bucket is set to Public Read/Write, or the bucket policy allows access from all IP addresses, the evaluation result is Incompliant. For remediation steps, seeIncompliance remediation.
Rule details
| Item | Description |
| Rule name | oss-bucket-authorize-specified-ip |
| Rule identifier | oss-bucket-authorize-specified-ip |
| Tag | OSS, Bucket, and BucketPolicy |
| Automatic remediation | Not supported |
| Trigger Type | Configuration change |
| Supported resource type | OSS bucket |
| Input parameter | None. |
Incompliance remediation
Configure a bucket policy that allows access only from specified IP addresses. For more information, seeTutorial: Share data across departments based on bucket policies.