Internet accessible S3 bucket via policy (only GetObject)

Severity: Info
Service: S3
Check ID: S3_PUBLIC_POLICY_GETOBJECT_ONLY

What this check finds

This is the right way to make an S3 bucket public when you don't want to put CloudFront in front of it. This may be done when a third-party caching service is being used and you don't care about direct access to the S3 bucket.

Passing looks like: S3 bucket not publicly exposed via policy.

How to fix it

If this is intentional (e.g. a public static site), no action is needed. If unexpected, remove the public GetObject statement from the bucket policy.

AWS console

S3 → Bucket → Permissions → Bucket Policy → Edit.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Internet accessible S3 bucket via policy (only GetObject)
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More S3 checks

All S3 checks