Findings receiver

findings-receiver
Medium

S3 bucket is publicly readable

Open in console Back to list

S3 bucket policy allows public read. Anonymous principals can list and download every object in the bucket.

Finding

Resource
example-bucket-7
Resource type
AwsS3Bucket
Account
prod-workloads
Provider
aws
Status
Open
Compliance
CIS AWS 1.5 / 2.1.5, PCI DSS 4.0 / 1.3.1

Provenance

Source ID
risk-0007
Dedupe key
id:risk-0007
Opened
2026-08-22T23:00:46+00:00
Status updated
2026-08-24T23:00:46+00:00
First received
2026-08-25T06:00:46+00:00
Last received
2026-08-25T06:00:46+00:00
Deliveries
1 (delivery #1)

Fields the normalizer did not map

These top-level keys were stored but not promoted to a column. If any of them matter for filtering, add the key name to FIELD_CANDIDATES in app/normalize.py and re-post the payload — the raw copy below is the source of truth, so nothing needs to be re-sent from Tenable.

customTicketRef eventType generatedAt

Raw payload as received

{
  "CloudRiskCompliances": [
    "CIS AWS 1.5 / 2.1.5",
    "PCI DSS 4.0 / 1.3.1"
  ],
  "CloudRiskEntity": {
    "entityType": "AwsS3Bucket",
    "id": "arn:aws:s3:::example-bucket-7",
    "name": "example-bucket-7"
  },
  "CloudRiskRiskPolicy": {
    "id": "pol-s3-public-read",
    "name": "S3 bucket is publicly readable"
  },
  "CloudRiskTenant": {
    "id": "123456789012",
    "name": "prod-workloads"
  },
  "Id": "risk-0007",
  "RiskConsoleUrl": "https://cloud.tenable.com/cns/risks/risk-0007",
  "RiskDescription": "S3 bucket policy allows public read. Anonymous principals can list and download every object in the bucket.",
  "RiskOpenStatusUpdateTime": "2026-08-22T23:00:46+00:00",
  "RiskSeverity": "Medium",
  "RiskStatus": "Open",
  "RiskStatusUpdateTime": "2026-08-24T23:00:46+00:00",
  "RiskSubStatus": null,
  "customTicketRef": "SEC-4207",
  "eventType": "risks.updated",
  "generatedAt": "2026-08-25T06:00:46+00:00",
  "provider": "aws"
}