Evaluates whether hotlink protection is enabled and a Referer whitelist is configured for each Object Storage Service (OSS) bucket. If both conditions are met, the resource is evaluated as compliant.
Scenarios
Enable hotlink protection and configure a Referer whitelist for an OSS bucket to prevent unauthorized access to bucket data.
Risk level
Default risk level: low.
When you apply this rule, you can change the risk level based on your business requirements.
Compliance evaluation logic
- If hotlink protection is enabled and a Referer whitelist is configured for an OSS bucket, the resource is evaluated as Compliant.
- If hotlink protection is disabled for an OSS bucket, the resource is evaluated as Incompliant. If hotlink protection is enabled but no Referer whitelist is configured for an OSS bucket, the resource is also evaluated as Incompliant. For more information about how to remediate an incompliant configuration, see Incompliance remediation.
Rule details
| Item | Description |
| Rule name | oss-bucket-referer-limit |
| Rule identifier | oss-bucket-referer-limit |
| Tag | OSS and Bucket |
| Automatic remediation | Not supported |
| Trigger type | Configuration change |
| Supported resource type | OSS bucket |
| Input parameter |
|
Incompliance remediation
Enable the hotlink protection feature for an OSS bucket. For more information, see Configure hotlink protection for a bucket.