Back to Checks
huaweicloud

OBS buckets are not publicly accessible

obs_bucket_public_access
Service: obsSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that Object Storage Service (OBS) buckets are not publicly accessible to prevent unauthorized access to stored objects.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Publicly accessible OBS buckets allow anyone on the internet to list, read, or modify stored objects, potentially exposing sensitive data to unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks obs_bucket_public_access

Recommendation

Remove public access permissions from OBS buckets and use IAM policies for controlled access.

Remediation

CLI

obsutil chattri obs://<bucket_name> -acl=private

Other

1Log on to the **Huawei Cloud console**.
2Navigate to **Object Storage Service**.
3Select the **bucket**.
4Click the **Permissions** tab.
5Remove any `public read` or `public read/write` permissions.
6Click **Save**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.obs.obs_client import obs_client


class obs_bucket_public_access(Check):
    """Check if OBS buckets are not publicly accessible."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for bucket in obs_client.buckets:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=bucket)
            report.region = bucket.region
            report.resource_id = bucket.name
            report.resource_arn = f"huaweicloud:obs:{bucket.region}:{obs_client.audited_account}:bucket/{bucket.name}"

            if bucket.is_public:
                report.status = "FAIL"
                report.status_extended = (
                    f"OBS bucket {bucket.name} is publicly accessible."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"OBS bucket {bucket.name} is not publicly accessible."
                )

            findings.append(report)

        return findings

References