OBS Bucket Policies Do Not Allow Blacklisted Actions

Rule Details

Application Scenarios

A bucket policy applies to the configured OBS bucket and objects in the bucket. You can use bucket policies to control the access of IAM users or other account to your OBS buckets. You are advised to apply the principle of least privilege to ensure that a bucket policy only grants necessary permissions for certain tasks.

Solution

Modify policies of non-compliant buckets with the visual editor or the JSON view to block the blacklisted actions.

Rule Logic

• If an OBS bucket does not have a policy that allows blacklisted actions for principals from other accounts, this bucket is compliant.
• If an OBS bucket has a policy that allows blacklisted actions for principals from other accounts, this bucket is non-compliant.