SG-032: Public Bucket / ACL

Severity: HIGH

Storage bucket or object ACL granting public access

Fires when

• An object or bucket is given a public-read (or public-read-write) ACL
• S3 public-access blocks (BlockPublicAcls / BlockPublicPolicy / IgnorePublicAcls) are disabled
• A bucket or IAM policy grants a wildcard Principal ("*")
• A GCS bucket grants IAM to allUsers / allAuthenticatedUsers

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.