OBS Bucket Policy Authorization Check

Rule Details

**Table 1** Rule details
Parameter	Description
Rule Name	obs-bucket-policy-grantee-check
Identifier	OBS Bucket Policy Authorization Check
Description	If an OBS bucket policy allows a prohibited access action, this policy is non-compliant.
Tag	obs, access-analyzer-verified
Trigger Type	Configuration change
Filter Type	obs.buckets
Rule Parameters	principal: authorized identities, for example, domain/aaaa:user/111111 and domain/bbbb sourceIp: authorized source IPs, for example 192.168.0.0/16 sourceVpc: authorized source VPCs. Enter VPC IDs, for example, vpcidaaaa. sourceVpce: authorized VPC endpoints. Enter VPC endpoint IDs, for example, vpceidaaaa. Note: The parameters should have the same format as the principals or conditions in OBS bucket policies.

Application Scenarios

A bucket policy applies to the configured OBS bucket and objects in the bucket. You can use bucket policies to control the access of IAM users or other account to your OBS buckets. You are advised to apply the principle of least privilege to ensure that a bucket policy only grants necessary permissions for certain tasks.

Solution

You can modify policies for non-compliant buckets through the visual editor or the JSON view to avoid prohibited access actions.

Rule Logic

If an OBS bucket policy assigns permissions that are subject to the principal and network restrictions you provide, the policy is compliant.
If an OBS bucket policy assigns permissions that are not subject to the principal and network restrictions you provide, the policy is non-compliant.