Evaluates whether an OSS bucket policy grants read or write permissions to anonymous accounts. The rule returns Compliant if no such permissions are granted or no bucket policy is configured.
Scenarios
Use this rule to enforce least-privilege access on OSS buckets and prevent data leaks from overly broad permissions.
Risk level
Default risk level: high.
You can change the risk level when you apply this rule.
Compliance evaluation logic
- Compliant: The bucket policy does not grant read or write permissions to anonymous accounts, or no bucket policy is configured.
- Non-compliant: The bucket policy grants read or write permissions to an anonymous account. To fix this, see Remediation.
Rule details
| Item | Description |
| Rule name | oss-bucket-policy-no-any-anonymous |
| Rule identifier | oss-bucket-policy-no-any-anonymous |
| Tag | OSS, Bucket, and BucketPolicy |
| Automatic remediation | Not supported |
| Trigger type | Configuration change |
| Supported resource type | OSS bucket |
| Input parameter | None. |
Remediation
Grant read and write permissions on the OSS bucket to specific users instead of anonymous accounts. Tutorial: Share data across departments based on bucket policies.