Guides

Ensure OSS Bucket is Not Allow Delete Action From All Principal

Prevent leaking private information to the entire internet or allow unauthorized data tampering/deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is DeleteBucket, for all Principals. You can configure RAM policies to manage user access to your resources stored in Object Storage Service (OSS). A RAM policy contains a version number and a statement. Each statement contains the following elements: Effect, Action, Resource, and Condition. The Condition element is optional.

Suggest Edits

Risk Level: high
Platform: Alicloud
Spectral Rule ID: TFALCLD050

REMEDIATION

set policy to to not accept 'delete' action from all principals

policy = <<POLICY
{"Statement": [
  {
  "Action": [
    "oss:PutObject", "oss:DeleteBucket"
  ],
- "Effect": "Allow",
+ "Effect": "Deny",
  "Principal": [
    "*"
  ]
  }
]}

Read more:

Updated over 1 year ago