S3 access control lists (ACLs) should not be used to manage user access to buckets

[jchrisfarris]

Describe the bug
The proper way to ensure that ACLs are not used to manage object and bucket access is to disable them via the Bucket Owner Enforced setting in S3

Steampipe version (steampipe -v)
v18.0

Plugin version (steampipe plugin list)
Default in SPC
Mod version 0.54.0

To reproduce
An S3 bucket with either of the two settings bucket owner preferred or object writer still allow ACLs to be used. At the time the mod only looks for the presence of any ACLs, not to see if ACLs are disabled.

Expected behavior
The mod should report this finding as non-compliant if the ownership setting is not bucket owner enforced

Additional context
Add any other context about the problem here.

[rajlearner17]

This is derived from FSBP S3.12) > query used: s3_bucket_acls_should_prohibit_user_access.sql -- We are re-evaluating based on your suggestion to explore if we can add any direct column for Bucket owner enforced in the table or current evaluation is correct with additional checks as ACLs are disabled in it?

[jchrisfarris]

ACLs aren't "disabled", they're just not present. ACLs are only disabled when the Bucket owner enforced setting is set.

[rajlearner17]

@jchrisfarris, would it be possible for you to try it issue-539 and share your feedback?