Storage / Object / Controls / v2026.11
Restrict Bucket Listing to Explicitly Authorized Identities
CCC.ObjStor.CN15 · Access Control
Ensure that the set of object keys and listing metadata in a bucket is disclosed only to identities explicitly granted list permission, since keys and metadata may themselves carry sensitive information.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.ObjStor.CP02 | Storage Objects | The service always stores each data element as an object that contains both the data and its metadata, addressed by a unique key within a bucket. |
| CCC.Core.CP03 | Access Log Publication | The service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors. |
| CCC.Core.CP20 | Resource Tagging | The service provides users with the ability to tag a child resource with metadata that can be reviewed or queried. |
Related Threats
| ID | Title | Description |
|---|
| CCC.ObjStor.TH11 | Object Keys and Listing Metadata Expose Sensitive Information | Sensitive values may be placed in object keys, user-defined metadata, or tags. These values are returned by bucket listing operations and recorded in access logs and request URLs, which are governed by weaker access controls than the object content. This results in a loss of confidentiality without any object being read. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.ObjStor.CN15.AR01 | When a request lists the objects in a bucket, the service MUST deny the request unless the identity holds an explicit list permission on that bucket. | tlp-green, tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| CCM | IAM-05 | Least Privilege |