Severity :
...
High
Description: This control ensures that OCI Object Storage pre-authenticated requests has short expiration time-frame ensures that access does not last longer than intended. Pre-authenticated requests allow for users who are not in the tenancy to access buckets,
...
ensuring least access prevents malicious entities from leveraging this type of access to edit or delete objects in a bucket. A unique URL is generated for pre-authenticated request. When creating pre-authenticated Requests, ensure the expiration date-time is limited to the minimum time possible
Remediation Steps:
Perform following to create a pre-authenticated request with short expiration:
Login to the OCI console at https://www.oracle.com/cloud/sign-in.html .
In navigation menu and click Storage.
Under Object Storage, click Buckets.
Click the bucket name.
Click Pre-Authenticated Requests under Resources.
Click Create Pre-Authenticated Request.
Provide Name, Pre-Authenticated Request Target (Bucket or object), Access Type, Expiration, Object Listing permission.
Under Resources, click Metrics.
Click Create Pre-Authenticated Request.
On the details dialog box after creation, copy the URI shown to store in durable storage for future references.
Click Close.
Important:
A pre-authenticated request can't be edited. To change expiry options in response to changing requirements, a new pre-authenticated request creation is required.
Reference: