S3-01: S3 public access block¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- All four PublicAccessBlock settings are enabled.
Example failures:
- … PublicAccessBlock setting(s) disabled: …
- No PublicAccessBlockConfiguration exists on the state bucket. Enclave bootstrap state could be exposed via public ACLs or policies.
- No PublicAccessBlockConfiguration exists on the state bucket.
How to fix¶
- Enable all four PublicAccessBlock settings on the state bucket to prevent any public access path.
- Enable all four PublicAccessBlock settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No target bucket specified; skipping check.
ERROR:
- Could not retrieve public access block: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--region |
AWS region. |
--target-bucket |
S3 bucket holding the enclave's bootstrap state. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | s3.get_public_access_block |
s3:GetBucketPublicAccessBlock |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Evidence recorded¶
Keys in the finding's evidence: config, disabled_settings, public_access_block
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).