Make the check opt-in via three audit_config keys (disabled by default),
lower severity to low, and clarify that this is a spot-check sample.
- prowler/config/config.yaml: add s3_bucket_object_public_enabled
(False), _max_objects (100), _sample_size (3) with guidance pointing
to s3_bucket_acl_prohibited for comprehensive coverage.
- Check early-returns when disabled; otherwise reads max_objects and
sample_size from audit_config. Uses Check_Report_AWS. Compares the
AllUsers group URI exactly instead of substring-matching. PASS
message discloses the sample size and recommends disabling ACLs via
Object Ownership for full assurance.
- metadata.json: Severity -> low; Description, Notes and Recommendation
disclose the sampling limitation and cross-reference
s3_bucket_acl_prohibited; RelatedTo links the two checks.
- Unit tests cover: disabled-by-default (no findings), empty bucket
PASS, private-objects PASS, public-object FAIL, AccessDenied MANUAL,
other ClientError MANUAL.
Synchx00
a812249c4c