This skill provides step-by-step procedures for identifying and remediating Amazon S3 bucket misconfigurations that expose sensitive data to unauthorized access. It covers enabling S3 Block Public Access at account and bucket levels, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and deploying automated remediation using AWS Config and Lambda.
This skill provides step-by-step procedures for identifying and remediating Amazon S3 bucket misconfigurations that expose sensitive data to unauthorized access. It covers enabling S3 Block Public Access at account and bucket levels, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and deploying automated remediation using AWS Config and Lambda.
When AWS Config or Security Hub reports S3 buckets with public access or missing encryption
When a security scan reveals S3 bucket policies granting access to Principal "*" (everyone)
When preparing for a data protection audit requiring evidence of storage security controls
When responding to a data exposure incident involving publicly accessible S3 objects
When establishing preventive controls for new S3 bucket creation across an AWS Organization
Do not use for Azure Blob Storage or GCP Cloud Storage misconfigurations, for S3 data classification (see implementing-cloud-dlp-policy), or for S3 access pattern analysis unrelated to security.
Common Misconfigurations & Verification
Bucket-level Block Public Access without account-level: a newly created bucket can still be made public. Verify both: aws s3control get-public-access-block --account-id 123456789012 and aws s3api get-public-access-block --bucket NAME.
BucketOwnerEnforced silently breaks ACL-dependent workflows (S3 server-access-log delivery, CloudFront OAI, cross-account ACL grants). Confirm with aws s3api get-bucket-ownership-controls and test the downstream consumer before declaring success.
aws:kms default encryption without KMS key-policy grants: principals lacking kms:Decrypt/kms:GenerateDataKey on the CMK get AccessDenied on GetObject/PutObject. Verify the key policy and run a test get-object.
DenyUnencryptedUploads keyed on s3:x-amz-server-side-encryption blocks uploads that rely on bucket default encryption (the header isn't sent). Test aws s3api put-object without the SSE header.
SCP exception ARN drift: a Deny on s3:PutBucketPublicAccessBlock with a PrincipalArn exception locks out admins if the ARN (path, wildcards) doesn't match the real role.
Verify it actually works:aws s3api get-bucket-policy-status --bucket NAME returns IsPublic: false; IAM Access Analyzer shows no external-access findings after a rescan; an anonymous curl of a known object returns 403; and aws cloudtrail data events / server access logs confirm access is being captured. Don't trust "remediated" until all four hold.
Prerequisites
AWS account with S3 administrative permissions (s3:, s3-outposts:)
AWS Config enabled to evaluate S3 resource compliance
AWS CloudTrail logging S3 data events for access auditing
Macie enabled for sensitive data discovery in S3 buckets
Workflow
Step 1: Identify All Public and Misconfigured Buckets
Use multiple detection methods to identify S3 buckets with public access. Rely on AWS Config rules, S3 Access Analyzer, and Macie rather than manual inspection.
# Enable S3 Access Analyzer for external access detection
aws accessanalyzer create-analyzer \
--analyzer-name s3-analyzer \
--type ACCOUNT
# List all S3 buckets with public access indicators
aws s3api list-buckets --query 'Buckets[*].Name' --output text | whileread bucket; do
public_status=$(aws s3api get-public-access-block --bucket "$bucket" 2>/dev/null)
if [ $? -ne 0 ]; thenecho"NO PUBLIC ACCESS BLOCK: $bucket"fidone# Check bucket policies for public access grants
aws s3api list-buckets --query 'Buckets[*].Name' --output text | whileread bucket; do
policy=$(aws s3api get-bucket-policy --bucket "$bucket" 2>/dev/null)
ifecho"$policy" | grep -q '"Principal":"*"' 2>/dev/null; thenecho"PUBLIC POLICY DETECTED: $bucket"fidone# Use AWS Config to find non-compliant buckets
aws configservice get-compliance-details-by-config-rule \
--config-rule-name s3-bucket-public-read-prohibited \
--compliance-types NON_COMPLIANT \
--query 'EvaluationResults[*].EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId'
Step 2: Enable S3 Block Public Access at Account Level
Apply the four Block Public Access settings at the AWS account level as a safety net. This prevents any bucket in the account from being made public, regardless of individual bucket policies or ACLs.
Step 3: Audit and Remediate Bucket Policies and ACLs
Review all bucket policies for overly permissive Principal statements and remove legacy ACLs. Enforce bucket ownership controls to disable ACLs entirely.
Configure S3 server access logging and CloudTrail data events to track all object-level operations. Set up EventBridge rules to alert on suspicious access patterns.
Four account-level and bucket-level settings that override any policy or ACL granting public access to S3 resources
Bucket Policy
JSON-based resource policy attached to an S3 bucket defining who can access what objects under which conditions
ACL (Access Control List)
Legacy S3 access mechanism that grants permissions at the bucket or object level; should be disabled via BucketOwnerEnforced
BucketOwnerEnforced
Ownership control setting that disables all ACLs on a bucket, making the bucket owner the sole authority for access control
Server-Side Encryption
Automatic encryption of objects at rest using AES-256 (SSE-S3), AWS KMS (SSE-KMS), or customer-provided keys (SSE-C)
VPC Endpoint
Private connection between a VPC and S3 that restricts bucket access to traffic originating from within the VPC
S3 Access Analyzer
IAM Access Analyzer capability that identifies S3 buckets shared with external entities outside the account or organization
Tools & Systems
AWS Config: Evaluates S3 bucket compliance against managed rules and triggers auto-remediation for non-compliant resources
Amazon Macie: Discovers and classifies sensitive data in S3 buckets to identify which misconfigurations pose the highest data exposure risk
IAM Access Analyzer: Identifies S3 buckets with policies or ACLs that grant access to external principals
S3 Storage Lens: Provides organization-wide visibility into S3 usage patterns, access metrics, and security anomalies
Prowler: Open-source tool that checks S3 security configurations against CIS benchmarks and best practices
Common Scenarios
Scenario: Data Breach from Publicly Readable S3 Bucket Containing PII
Context: A security researcher reports that an S3 bucket containing 273,000 bank transfer PDFs is publicly readable. The bucket was created by a developer who needed to share files with an external partner and set the ACL to public-read.
Approach:
Immediately enable Block Public Access on the specific bucket to stop the exposure
Revoke all public ACLs by setting BucketOwnerEnforced ownership controls
Audit CloudTrail and S3 access logs to determine which IP addresses accessed the exposed objects
Run Macie on the bucket to classify the types of PII exposed and assess regulatory notification requirements
Enable account-level Block Public Access to prevent recurrence across all buckets
Deploy an SCP preventing any principal except SecurityAdmin from modifying Block Public Access settings
Create a pre-signed URL mechanism or S3 Access Point for the legitimate partner sharing use case
Pitfalls: Enabling Block Public Access without notifying the team that set up the public access breaks their workflow. Not running access log analysis before remediation loses evidence of who accessed the exposed data.
Output Format
S3 Bucket Security Remediation Report
=======================================
Account: 123456789012
Assessment Date: 2025-02-23
Buckets Scanned: 156
ACCOUNT-LEVEL CONTROLS:
Block Public Access: ENABLED (all four settings)
SCP Preventing Removal: DEPLOYED
CRITICAL FINDINGS (Remediated):
[S3-001] production-uploads - Public READ via ACL
Status: REMEDIATED - BucketOwnerEnforced applied
Objects Exposed: 273,412
Duration of Exposure: 47 days
Unique External IPs Accessed: 1,247
[S3-002] analytics-export - Public bucket policy (Principal: *)
Status: REMEDIATED - Policy replaced with VPC endpoint restriction
Sensitive Data (Macie): 12,400 objects with PII detected
HIGH FINDINGS:
[S3-003] 14 buckets missing default encryption
Status: REMEDIATED - KMS encryption enabled
[S3-004] 8 buckets without server access logging
Status: REMEDIATED - Logging enabled to centralized log bucket
SUMMARY:
Buckets Remediated: 24/156
Encryption Coverage: 100%
Access Logging Coverage: 100%
Block Public Access: 156/156 buckets
