S3 bucket policy does not allow cross-account access

Check ID: s3_bucket_cross_account_access
Provider: AWS
Service: s3
Severity: HIGH
Categories: identity-access, trust-boundaries
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 bucket policies are analyzed for statements that grant cross-account access. Any policy that names principals outside the owning account (other account IDs or Principal: "*") is treated as cross-account; absence of a policy implies no cross-account grants.

Risk

Cross-account grants can let external principals read, write, or administer the bucket, impacting:

Confidentiality: unauthorized object access/exfiltration
Integrity: object tampering, policy or encryption changes
Availability: deletions, versioning changes, or lockouts causing data loss and downtime

Recommendation

Enforce least privilege: limit bucket policy Principal to your account or approved org IDs with fixed values; avoid wildcards. Use role-based cross-account access with scoped permissions when needed. Add defense-in-depth conditions (private networks, TLS), and periodically review for unintended external access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api delete-bucket-policy —bucket <example_resource_name>

# Terraform: restrict bucket policy to this AWS account only
resource "aws_s3_bucket_policy" "<example_resource_name>" {
  bucket = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::<example_resource_id>:root" } # Critical: limits access to the bucket owner's account, preventing cross-account access
      Action    = "s3:*"
      Resource  = [
        "arn:aws:s3:::<example_resource_name>",
        "arn:aws:s3:::<example_resource_name>/*"
      ]
    }]
  })
}

# CloudFormation: restrict bucket policy to this AWS account only
Resources:
  <example_resource_name>BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: <example_resource_name>
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root  # Critical: limits access to the bucket owner's account, preventing cross-account access
            Action: s3:*
            Resource:
              - !Sub arn:aws:s3:::<example_resource_name>
              - !Sub arn:aws:s3:::<example_resource_name>/*

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_cross_account_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has bucket ACLs disabled S3 bucket replicates to a bucket in another region

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires