IBM Cloud Object Storage bucket public access toggle enables without confirmation
0 reputation · 14 Aug 2021, 13:14 UTC
IBM Cloud Object Storage bucket public access toggle enables without confirmation
The goal is to determine whether an IBM Cloud Object Storage bucket can be accidentally made publicly accessible through the public access toggle without a mandatory confirmation step.
Available research indicates the bucket public access flag can be switched on without mandatory confirmation, creating an immediate exposure risk. This behavior requires current verification against documented IBM Cloud Object Storage behavior, and no confirmed error string or version scope is available from the supplied research.
Does enabling bucket public access require an explicit confirmation in the IBM Cloud console? Are there IAM or account-level controls that can block changes to the bucket public access flag? Does changing the public access flag generate an auditable event in IBM Cloud Activity Tracker?
ibm