Object Storage bucket is not publicly accessible

Check ID: objectstorage_bucket_not_publicly_accessible
Provider: Oracle Cloud (OCI)
Service: objectstorage
Severity: CRITICAL
Categories: internet-exposed
Resource type: Bucket

What this check verifies

OCI Object Storage buckets are assessed for public accessibility. Buckets configured as NoPublicAccess deny anonymous reads; any other public access setting indicates bucket contents may be reachable without authentication.

Risk

Public buckets enable unauthenticated downloads and content listing, compromising confidentiality and exposing metadata. Hotlinking can drive unexpected egress costs and degrade availability through bandwidth exhaustion and service abuse.

Recommendation

Keep buckets private (NoPublicAccess) under the least privilege principle. For external sharing, use pre-authenticated requests or signed URLs with scoped permissions and expiry. Restrict access via IAM policies, enforce guardrails (e.g., Security Zones), and regularly review bucket visibility.

Remediation

CLI
Terraform
Dashboard steps

oci os bucket update —namespace-name <namespace> —bucket-name <bucket-name> —public-access-type NoPublicAccess

resource "oci_objectstorage_bucket" "<example_resource_name>" {
  compartment_id     = "<example_resource_id>"
  name               = "<example_resource_name>"
  namespace          = "<example_namespace_name>"
  public_access_type = "NoPublicAccess" # Critical: makes the bucket private
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_bucket_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Object Storage bucket has write-level logging enabled Object Storage bucket has versioning enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires