When object-level permissions are enabled on a bucket, a permission may be attached to an individual object at upload or afterwards that grants access beyond what the bucket-level policy allows. The object becomes readable or writable by entities the bucket policy does not name, and a review of the bucket policy does not reveal the grant. This results in a loss of confidentiality or integrity of the affected objects.
Object-Level Permissions Diverge from Bucket Policy
CCC.ObjStor.TH06
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.CP05 | Store New Objects | The service always allows a user to store a new object in a bucket under a key that is not yet in use. |
| CCC.ObjStor.CP10 | Object Level Access Control | The service can enforce access permissions on an individual object, independently of the permissions applied to the containing bucket. Whether object-level permissions are enabled by default on a new bucket varies by provider. |
| CCC.ObjStor.CP16 | Bucket-Level-Only Access Policy | The service may be configured to disable object-level permissions on a bucket, so that access to every object is governed solely by the bucket-level policy. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.CN02 | Enforce Bucket-Level-Only Access to Prevent Inconsistent Permissions | Ensure that a bucket-level-only access policy is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege. |