Back to Checks
oraclecloud

Object Storage bucket is not publicly accessible

objectstorage_bucket_not_publicly_accessible
Service: objectstorageSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Bucket

OCI Object Storage buckets are assessed for public accessibility. Buckets configured as NoPublicAccess deny anonymous reads; any other public access setting indicates bucket contents may be reachable without authentication.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Public buckets enable unauthenticated downloads and content listing, compromising confidentiality and exposing metadata. Hotlinking can drive unexpected egress costs and degrade availability through bandwidth exhaustion and service abuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks objectstorage_bucket_not_publicly_accessible

Recommendation

Keep buckets private (NoPublicAccess) under the least privilege principle. For external sharing, use pre-authenticated requests or signed URLs with scoped permissions and expiry. Restrict access via IAM policies, enforce guardrails (e.g., Security Zones), and regularly review bucket visibility.

Remediation

CLI

oci os bucket update --namespace-name <namespace> --bucket-name <bucket-name> --public-access-type NoPublicAccess

Terraform

resource "oci_objectstorage_bucket" "<example_resource_name>" {
  compartment_id     = "<example_resource_id>"
  name               = "<example_resource_name>"
  namespace          = "<example_namespace_name>"
  public_access_type = "NoPublicAccess" # Critical: makes the bucket private
}

Other

1Sign in to the OCI Console
2Go to Object Storage > Buckets and open <bucket-name>
3Click Edit (Bucket details)
4Set Public access type to "No public access"
5Click Save

Check Code

"""Check if Object Storage buckets are not publicly accessible."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_bucket_not_publicly_accessible(Check):
    """Check if Object Storage buckets are not publicly accessible."""

    def execute(self) -> Check_Report_OCI:
        """Execute the objectstorage_bucket_not_publicly_accessible check.

        Returns:
            List of Check_Report_OCI objects with findings
        """
        findings = []

        for bucket in objectstorage_client.buckets:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=bucket,
                region=bucket.region,
                resource_name=bucket.name,
                resource_id=bucket.id,
                compartment_id=bucket.compartment_id,
            )

            # Check if bucket has public access
            # NoPublicAccess means the bucket is not publicly accessible
            if bucket.public_access_type == "NoPublicAccess":
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} is not publicly accessible."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Bucket {bucket.name} has public access type: {bucket.public_access_type}."

            findings.append(report)

        return findings

References