【AWS CLI】パブリック公開されているS3バケットを探す

$ aws s3api get-bucket-policy-status --bucket example-public-bucket

{
    "PolicyStatus": {
        "IsPublic": true
    }
}

$ aws s3api get-bucket-policy-status --bucket example-bucket

{
    "PolicyStatus": {
        "IsPublic": false
    }
}

aws: [ERROR]: An error occurred (NoSuchBucketPolicy) when calling the GetBucketPolicyStatus operation: The bucket policy does not exist

$ aws s3api get-public-access-block --bucket example-bucket

{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": true,
        "BlockPublicPolicy": true,
        "RestrictPublicBuckets": true
    }
}

aws: [ERROR]: An error occurred (NoSuchPublicAccessBlockConfiguration) when calling the GetPublicAccessBlock operation: The public access block configuration was not found

$ aws s3control get-public-access-block --account-id 123456789012

{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": true,
        "BlockPublicPolicy": true,
        "RestrictPublicBuckets": true
    }
}

$ aws s3control get-public-access-block --account-id $(aws sts get-caller-identity --query Account --output text)

$ aws s3api get-bucket-acl --bucket example-bucket

{
    "Owner": {
        "ID": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
    },
    "Grants": [
        {
            "Grantee": {
                "ID": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
                "Type": "CanonicalUser"
            },
            "Permission": "FULL_CONTROL"
        }
    ]
}

{
    "Grantee": {
        "Type": "Group",
        "URI": "http://acs.amazonaws.com/groups/global/AllUsers"
    },
    "Permission": "READ"
}

$ aws s3api get-bucket-acl --bucket example-bucket \
    --query "Grants[?Grantee.URI!=null && (contains(Grantee.URI, 'AllUsers') || contains(Grantee.URI, 'AuthenticatedUsers'))]"

[]

$ aws s3api get-bucket-ownership-controls --bucket example-bucket

{
    "OwnershipControls": {
        "Rules": [
            {
                "ObjectOwnership": "BucketOwnerEnforced"
            }
        ]
    }
}

aws: [ERROR]: An error occurred (OwnershipControlsNotFoundError) when calling the GetBucketOwnershipControls operation: The bucket ownership controls were not found

$ for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
    is_public=$(aws s3api get-bucket-policy-status --bucket "$bucket" --query PolicyStatus.IsPublic --output text 2>/dev/null)
    if [ "$is_public" = "True" ]; then
      echo "$bucket"
    fi
done

example-public-bucket

$ for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
    is_public=$(aws s3api get-bucket-policy-status --bucket "$bucket" --query PolicyStatus.IsPublic --output text 2>/dev/null)
    restrict=$(aws s3api get-public-access-block --bucket "$bucket" --query PublicAccessBlockConfiguration.RestrictPublicBuckets --output text 2>/dev/null)
    printf "%-40s policy=%-5s restrict=%s\n" "$bucket" "${is_public:--}" "${restrict:--}"
done

example-assets-bucket                    policy=-     restrict=True
example-backup-bucket                    policy=-     restrict=-
example-bucket                           policy=False restrict=True
example-logs-bucket                      policy=False restrict=-
example-public-bucket                    policy=True  restrict=False