diff options
| author | Christian Cleberg <[email protected]> | 2026-03-03 19:13:49 -0600 |
|---|---|---|
| committer | GitHub <[email protected]> | 2026-03-03 19:13:49 -0600 |
| commit | 9c9fed1391f9405a6018cc0ef03dca618ab715be (patch) | |
| tree | f93b8262847809f371f6ea29a401f6d56a9ea09f | |
| parent | 8b71bdf249ab4cc0f0f2397ce65b078acf5e3673 (diff) | |
| download | cleberg.net-9c9fed1391f9405a6018cc0ef03dca618ab715be.tar.gz cleberg.net-9c9fed1391f9405a6018cc0ef03dca618ab715be.tar.bz2 cleberg.net-9c9fed1391f9405a6018cc0ef03dca618ab715be.zip | |
fix unintended subscripts in latest posts (#19)
| -rw-r--r-- | content/blog/2026-03-03-auditing-aws-s3.org | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/content/blog/2026-03-03-auditing-aws-s3.org b/content/blog/2026-03-03-auditing-aws-s3.org index 36e0839..70fb503 100644 --- a/content/blog/2026-03-03-auditing-aws-s3.org +++ b/content/blog/2026-03-03-auditing-aws-s3.org @@ -184,23 +184,23 @@ prevent it from becoming public if a policy or ACL were changed. * Common Exceptions and False Positives -- *Static website hosting*: Buckets used for static website hosting are +- =Static website hosting=: Buckets used for static website hosting are intentionally public. These will show up with ~TRUE~ overall status and public ACLs or policies. Confirm the business purpose with IT and document them as accepted exceptions rather than findings. -- *Policy_IsPublic with No Policy*: A ~No Policy~ result in the policy column is not +- =Policy_IsPublic with No Policy=: A ~No Policy~ result in the policy column is not a finding. It simply means no bucket policy is attached. The overall status depends on PAB and ACLs. -- *FALSE-VULNERABLE with FALSE overall status*: This is a configuration weakness +- =FALSE-VULNERABLE with FALSE overall status=: This is a configuration weakness rather than an active exposure finding. The bucket isn't currently public, but PAB is not fully enabled, meaning a future change could expose it. Write this up separately from buckets that are actively public, as the risk and remediation are different. -- *Cross-account or service-specific policies*: Some bucket policies grant access +- =Cross-account or service-specific policies=: Some bucket policies grant access to specific AWS accounts or services (e.g., CloudFront, Config, ELB logging). AWS may flag these as ~IsPublic~ even though they're not publicly accessible in practice. Review the actual bucket policy before raising it as a finding. -- *Region coverage*: If a bucket's region isn't in the ~AWS_REGIONS~ list, the +- =Region coverage=: If a bucket's region isn't in the ~AWS_REGIONS~ list, the script can't determine its location and will skip it with a warning. Make sure the region list in the script covers your organization's full footprint before treating the CSV as a complete population. |