Example SCP: Deny S3 bucket creation if ACLs are enabled

Photo by FLY:D on Unsplash

Example SCP: Deny S3 bucket creation if ACLs are enabled

Service Control Policy example that denies s3:CreateBucket permission unless the bucket owner enforced setting is applied for Object Ownership.

ยท

2 min read

Service Control Policy example: Deny s3:CreateBucket if S3 bucket ACLs are enabled

S3 Bucket ACLs are a legacy access control mechanism and AWS recommends disabling this when creating new S3 buckets. Since IAM is the defacto standard to secure AWS resources, it's best practice to use bucket policies to control access to objects in the S3 bucket.

From the AWS console, you'll receive a notice to disable ACLs when you're creating a new S3 bucket.

Application Load Balanced Fargate Service architecture diagram

To enforce object ownership within an AWS Organization for every user that wants to create new S3 buckets, you can apply the following Service Control Policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnforceS3BucketOwnerFullControl",
      "Action": "s3:CreateBucket",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-object-ownership": "BucketOwnerEnforced"
        }
      }
    }
  ]
}

How to create the AWS Service Control Policy

Log in to the AWS console and then go to the Service control policies tab under the AWS Organizations service where you can create the new policy. Note: make sure to have AWS Organizations enabled.

Learn more about AWS Service Control Policies

If you are in a position where you have responsibility for the AWS Cloud infrastructure, then look at The complete guide to AWS Service Control Policies.


Originally posted on Towards the Cloud

If you liked this post, then you can subscribe to my newsletter