AWS S3 public access
An S3 bucket was made (or allowed to become) publicly accessible — a bucket policy/ACL change or the removal of a public-access block.
What it detects
An S3 bucket was made (or allowed to become) publicly accessible — a bucket policy/ACL change or the removal of a public-access block. Public buckets are a leading cause of cloud data exposure and are frequently the final step in a data-theft chain.
MITRE ATT&CK mapping
- T1530Data from Cloud Storage· Collection
False positives and triage
Some buckets are intentionally public (static websites, public datasets). Confirm the bucket's intended exposure and whether the change removed a public-access block or granted a wildcard (*) principal.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/aws_s3_public_access.yaml, licensed under the Apache License 2.0.
id: cloud.aws.s3_public_access
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1530]
description: |
An S3 bucket was made (or allowed to become) publicly accessible — a bucket policy/ACL
change or the removal of a public-access block. Public buckets are a leading cause of
cloud data exposure and are frequently the final step in a data-theft chain.
match:
provider: AWS
event_action_any:
- PutBucketPolicy
- PutBucketAcl
- PutBucketPublicAccessBlock
- DeleteBucketPublicAccessBlock
- DeletePublicAccessBlock
correlation_keys: [user_name]
false_positive_guidance: |
Some buckets are intentionally public (static websites, public datasets). Confirm the
bucket's intended exposure and whether the change removed a public-access block or
granted a wildcard (`*`) principal.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.