mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-11-08 20:33:41 +00:00
Synchx00
a812249c4c
Make the check opt-in via three audit_config keys (disabled by default), lower severity to low, and clarify that this is a spot-check sample. - prowler/config/config.yaml: add s3_bucket_object_public_enabled (False), _max_objects (100), _sample_size (3) with guidance pointing to s3_bucket_acl_prohibited for comprehensive coverage. - Check early-returns when disabled; otherwise reads max_objects and sample_size from audit_config. Uses Check_Report_AWS. Compares the AllUsers group URI exactly instead of substring-matching. PASS message discloses the sample size and recommends disabling ACLs via Object Ownership for full assurance. - metadata.json: Severity -> low; Description, Notes and Recommendation disclose the sampling limitation and cross-reference s3_bucket_acl_prohibited; RelatedTo links the two checks. - Unit tests cover: disabled-by-default (no findings), empty bucket PASS, private-objects PASS, public-object FAIL, AccessDenied MANUAL, other ClientError MANUAL.