The service can enforce access permissions on an individual object, independently of the permissions applied to the containing bucket. Whether object-level permissions are enabled by default on a new bucket varies by provider.
Object Level Access Control
CCC.ObjStor.CP10
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.TH06 | Object-Level Permissions Diverge from Bucket Policy | When object-level permissions are enabled on a bucket, a permission may be attached to an individual object at upload or afterwards that grants access beyond what the bucket-level policy allows. The object becomes readable or writable by entities the bucket policy does not name, and a review of the bucket policy does not reveal the grant. This results in a loss of confidentiality or integrity of the affected objects. |