Scan S3 buckets for public-read permissions

s3-bucket-scan

#!/bin/bash

# requires jq: https://stedolan.github.io/jq/
# requires aws-cli: http://docs.aws.amazon.com/cli/latest/userguide/installing.html

for bucket in `aws s3 ls | awk '{print $NF}'`; do
	errors=$(expr $(aws s3api get-bucket-acl --bucket $bucket |
		jq '.Grants | .[] | if (.Permission == "READ" and (.Grantee.URI == "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" or .Grantee.URI == "http://acs.amazonaws.com/groups/global/AllUsers")) then "ERROR" else null end' |
		grep ERROR |
		wc -l))
	if [[ $errors > 0 ]]; then
		echo $bucket $errors
	fi
done