The service may be configured to disable object-level permissions on a bucket, so that access to every object is governed solely by the bucket-level policy.
Bucket-Level-Only Access Policy
CCC.ObjStor.CP16
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.TH06 | Object-Level Permissions Diverge from Bucket Policy | When object-level permissions are enabled on a bucket, a permission may be attached to an individual object at upload or afterwards that grants access beyond what the bucket-level policy allows. The object becomes readable or writable by entities the bucket policy does not name, and a review of the bucket policy does not reveal the grant. This results in a loss of confidentiality or integrity of the affected objects. |