S3 Glacier vault policy does not allow public access

Check ID: glacier_vaults_policy_public_access
Provider: AWS
Service: glacier
Severity: CRITICAL
Categories: internet-exposed
Resource type: Other

What this check verifies

Glacier vault access policy is evaluated for exposure to public principals. The finding highlights Allow statements that grant access to Principal: '*' (including wildcard forms), and notes when a vault lacks a policy.

Risk

Publicly grantable vault access undermines confidentiality and integrity. Anyone could list, retrieve, or delete archives, leading to data exposure or loss. Attackers may also trigger large retrieval operations, degrading availability and driving unexpected costs.

Recommendation

Enforce least privilege on vault policies: restrict to specific AWS accounts or roles, avoid Principal: '*', and grant only necessary actions. Apply defense in depth with Vault Lock for immutable retention and continuous review and monitoring of access to prevent broad or unintended exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws glacier delete-vault-access-policy —account-id <ACCOUNT_ID> —vault-name <VAULT_NAME>

# Glacier vault with no access policy (not public)
resource "aws_glacier_vault" "<example_resource_name>" {
  name = "<example_resource_name>"
  # access_policy omitted to remove any public access and pass the check
}

# CloudFormation: Glacier vault without an access policy (no public access)
Resources:
  <example_resource_name>:
    Type: AWS::Glacier::Vault
    Properties:
      VaultName: <example_resource_name>
      # AccessPolicy omitted to remove any public access and pass the check

References

https://docs.aws.amazon.com/amazonglacier/latest/dev/access-control-overview.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glacier_vaults_policy_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

FSx Windows file system uses Multi-AZ deployment Glue data catalog connection password is KMS-encrypted

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires