用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-3-1-4命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-aws-foundations-3.1.4 |
| description | Ensure that S3 is configured with 'Block Public Access' enabled |
| category | cis-storage |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","s3","public-access","block-public-access","access-control"] |
| cis_id | 3.1.4 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-3.1.1","cis-aws-foundations-3.1.2","cis-aws-foundations-3.1.3"] |
| prerequisites | [] |
| severity_boost | {} |
Amazon S3 provides Block public access (bucket settings) and Block public access (account settings) to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, Block public access (bucket settings) prevents an individual bucket and its contained objects from becoming publicly accessible. Similarly, Block public access (account settings) prevents all buckets and their contained objects from becoming publicly accessible across the entire account.
Amazon S3 Block public access (bucket settings) prevents the accidental or malicious public exposure of data contained within the respective bucket(s).
Amazon S3 Block public access (account settings) prevents the accidental or malicious public exposure of data contained within all buckets of the respective AWS account.
Whether to block public access to all or some buckets is an organizational decision that should be based on data sensitivity, least privilege, and use case.
When you apply Block Public Access settings to an account, the settings apply to all AWS regions globally. The settings may not take effect in all regions immediately or simultaneously, but they will eventually propagate to all regions.
If utilizing Block Public Access (bucket settings):
If utilizing Block Public Access (account settings):
Block public access (account settings).Check bucket-level Block Public Access:
aws s3 ls
aws s3api get-public-access-block --bucket <bucket-name>
Output if Block Public Access is enabled:
{
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"IgnorePublicAcls": true,
"BlockPublicPolicy": true,
"RestrictPublicBuckets": true
}
}
If the output reads false for the separate configuration settings, then proceed with the remediation.
Check account-level Block Public Access:
aws s3control get-public-access-block --account-id <account-id> --region <region-name>
Output if Block Public Access is enabled:
{
"PublicAccessBlockConfiguration": {
"IgnorePublicAcls": true,
"BlockPublicPolicy": true,
"BlockPublicAcls": true,
"RestrictPublicBuckets": true
}
}
If the output reads false for the separate configuration settings, then proceed with the remediation.
All four Block Public Access settings should be set to true:
BlockPublicAcls: trueIgnorePublicAcls: trueBlockPublicPolicy: trueRestrictPublicBuckets: trueThis should be verified at either the bucket level or account level, depending on organizational requirements.
If utilizing Block Public Access (bucket settings):
If utilizing Block Public Access (account settings):
Block Public Access (account settings).Edit to change the block public access settings for all the buckets in your AWS account.Save.confirm. Then click Confirm to save your changes.Enable Block Public Access on a specific bucket:
aws s3api put-public-access-block --bucket <bucket-name> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
Enable Block Public Access for the account:
aws s3control put-public-access-block \
--public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true, BlockPublicPolicy=true, RestrictPublicBuckets=true \
--account-id <account-id>
By default, new S3 buckets and objects are created with public access disabled, but the Block Public Access settings (at the bucket or account level) are not enforced. They must be explicitly enabled to prevent future public access changes.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists | x | x | x |
| v7 | 14.6 Protect Information through Access Control Lists | x | x | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1530 | TA0009 | M1022 |
Level 1 | Automated