From 9c9fed1391f9405a6018cc0ef03dca618ab715be Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Tue, 3 Mar 2026 19:13:49 -0600 Subject: fix unintended subscripts in latest posts (#19) --- content/blog/2026-03-03-auditing-aws-s3.org | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'content/blog') diff --git a/content/blog/2026-03-03-auditing-aws-s3.org b/content/blog/2026-03-03-auditing-aws-s3.org index 36e0839..70fb503 100644 --- a/content/blog/2026-03-03-auditing-aws-s3.org +++ b/content/blog/2026-03-03-auditing-aws-s3.org @@ -184,23 +184,23 @@ prevent it from becoming public if a policy or ACL were changed. * Common Exceptions and False Positives -- *Static website hosting*: Buckets used for static website hosting are +- =Static website hosting=: Buckets used for static website hosting are intentionally public. These will show up with ~TRUE~ overall status and public ACLs or policies. Confirm the business purpose with IT and document them as accepted exceptions rather than findings. -- *Policy_IsPublic with No Policy*: A ~No Policy~ result in the policy column is not +- =Policy_IsPublic with No Policy=: A ~No Policy~ result in the policy column is not a finding. It simply means no bucket policy is attached. The overall status depends on PAB and ACLs. -- *FALSE-VULNERABLE with FALSE overall status*: This is a configuration weakness +- =FALSE-VULNERABLE with FALSE overall status=: This is a configuration weakness rather than an active exposure finding. The bucket isn't currently public, but PAB is not fully enabled, meaning a future change could expose it. Write this up separately from buckets that are actively public, as the risk and remediation are different. -- *Cross-account or service-specific policies*: Some bucket policies grant access +- =Cross-account or service-specific policies=: Some bucket policies grant access to specific AWS accounts or services (e.g., CloudFront, Config, ELB logging). AWS may flag these as ~IsPublic~ even though they're not publicly accessible in practice. Review the actual bucket policy before raising it as a finding. -- *Region coverage*: If a bucket's region isn't in the ~AWS_REGIONS~ list, the +- =Region coverage=: If a bucket's region isn't in the ~AWS_REGIONS~ list, the script can't determine its location and will skip it with a warning. Make sure the region list in the script covers your organization's full footprint before treating the CSV as a complete population. -- cgit v1.2.3