Back to Checks
aws

S3 Glacier vault has no policy or its policy does not allow access to everyone

glacier_vaults_policy_public_access
Service: glacierSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

Glacier vault access policy is evaluated for exposure to public principals. The finding highlights Allow statements that grant access to Principal: '*' (including wildcard forms), and notes when a vault lacks a policy.

Prowler logoProwlerprowler-provider-aws

Risk

Publicly grantable vault access undermines confidentiality and integrity. Anyone could list, retrieve, or delete archives, leading to data exposure or loss. Attackers may also trigger large retrieval operations, degrading availability and driving unexpected costs.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glacier_vaults_policy_public_access

Recommendation

Enforce least privilege on vault policies: restrict to specific AWS accounts or roles, avoid Principal: '*', and grant only necessary actions. Apply defense in depth with Vault Lock for immutable retention and continuous review and monitoring of access to prevent broad or unintended exposure.

Remediation

CLI

aws glacier delete-vault-access-policy --account-id <ACCOUNT_ID> --vault-name <VAULT_NAME>

Terraform

# Glacier vault with no access policy (not public)
resource "aws_glacier_vault" "<example_resource_name>" {
  name = "<example_resource_name>"
  # access_policy omitted to remove any public access and pass the check
}

NativeIaC

# CloudFormation: Glacier vault without an access policy (no public access)
Resources:
  <example_resource_name>:
    Type: AWS::Glacier::Vault
    Properties:
      VaultName: <example_resource_name>
      # AccessPolicy omitted to remove any public access and pass the check

Other

1In AWS Console, open Amazon S3 Glacier (Classic)
2Go to Vaults and select the target vault
3Open the Access policy tab and click Edit
4Remove the policy (clear all content) or delete it
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glacier.glacier_client import glacier_client


class glacier_vaults_policy_public_access(Check):
    def execute(self):
        findings = []
        for vault in glacier_client.vaults.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=vault)
            report.status = "PASS"
            report.status_extended = f"Vault {vault.name} has policy which does not allow access to everyone."

            public_access = False
            if vault.access_policy:
                for statement in vault.access_policy["Statement"]:
                    # Only check allow statements
                    if statement["Effect"] == "Allow":
                        if (
                            "*" in statement["Principal"]
                            or (
                                "AWS" in statement["Principal"]
                                and "*" in statement["Principal"]["AWS"]
                            )
                            or (
                                "CanonicalUser" in statement["Principal"]
                                and "*" in statement["Principal"]["CanonicalUser"]
                            )
                        ):
                            public_access = True
                            break
            else:
                report.status_extended = f"Vault {vault.name} does not have a policy."
            if public_access:
                report.status = "FAIL"
                report.status_extended = (
                    f"Vault {vault.name} has policy which allows access to everyone."
                )

            findings.append(report)

        return findings

References