The service always allows a user to store a new object in a bucket under a key that is not yet in use.
Store New Objects
CCC.ObjStor.CP05
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.TH04 | Objects are Encrypted with Keys Outside Organizational Control | An identity with write access may store or re-encrypt objects using a customer-provided key that the service does not retain, or a key held in a key management service outside the organization's control. The service then holds ciphertext it cannot decrypt on the organization's behalf, so the plaintext is available only to the holder of the foreign key. This results in a loss of availability of the affected data and, where the key holder is external, a loss of confidentiality. |
| CCC.ObjStor.TH06 | Object-Level Permissions Diverge from Bucket Policy | When object-level permissions are enabled on a bucket, a permission may be attached to an individual object at upload or afterwards that grants access beyond what the bucket-level policy allows. The object becomes readable or writable by entities the bucket policy does not name, and a review of the bucket policy does not reveal the grant. This results in a loss of confidentiality or integrity of the affected objects. |
| CCC.ObjStor.TH12 | Untrusted Content is Written to Buckets | Write access may be granted to external systems or through signed URLs without constraints on object content, type, or size. Objects of arbitrary content are stored and later consumed by downstream processes. This results in a loss of integrity for systems that trust the bucket's contents. |