Skip to main content

Security Tool Bypass

Buckets that appear safe to tools relying on APIs the bucket policy denies, plus latent public read exposure masked only by Public Access Block.

Background

When a bucket policy denies s3:GetBucketPolicyStatus or s3:GetBucketAcl to the scanning role, security tools cannot determine whether the bucket is safe. Most tools silently pass these buckets. Stave treats the gap as a finding via CTL.S3.INCOMPLETE.001 — if safety cannot be proven, the bucket is flagged.

Separately, a bucket with Public Access Block enabled may have an underlying policy granting Principal: "*". The bucket is not currently exposed, but removing PAB would immediately make it public. Stave flags this latent exposure.

Buckets

infra-deploy-artifacts — bucket policy denies GetBucketAcl/GetBucketPolicyStatus to scanning roles. PAB is enabled, but safety is unprovable because the scanner cannot read the policy or ACL.

marketing-assets-cdn — PAB is enabled, but the underlying policy grants Principal: "*". Currently safe only because PAB masks the exposure. One PAB change away from full public access.

Triggered Controls

ControlResourceDescription
CTL.S3.INCOMPLETE.001infra-deploy-artifactsComplete Data Required — zero-tolerance
CTL.S3.PUBLIC.005marketing-assets-cdnNo Latent Public Read Exposure

Expected Findings

2 violations across 2 resources.