SH401: S3 bucket is publicly accessible

Severity: high · Category: security · Applies to: cloudformation, terraform

Why it matters

A public S3 bucket lets anyone on the internet read, and sometimes write, its objects. Public buckets are a leading cause of data leaks.

How to fix

Use a private ACL, enable all four settings of the public access block, and grant access with specific principals or CloudFront origin access control.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH401

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH401