Project summary
In this lab, I created a controlled public exposure in an S3 bucket and used AWS-native services to detect the insecure configuration, investigate the change, generate an alert, and restore the bucket to a secure state.
IAM Access Analyzer identified the exposure, CloudTrail provided the change history, and EventBridge + SNS generated an email notification.
Controlled public exposure
I created a disposable bucket containing only a test file (dummy.txt).
I then temporarily disabled the relevant Block Public Access protections and applied a bucket policy allowing public s3:GetObject access to the test object.
No sensitive data was stored in the bucket during the lab.
Detection with IAM Access Analyzer
IAM Access Analyzer identified that the bucket was publicly accessible.
The finding showed that the exposure was caused by the bucket policy and that public read access was available through s3:GetObject.
The finding confirmed that the bucket was publicly exposed through the configured policy.
Investigation with CloudTrail
After detection, I reviewed CloudTrail to confirm the change that caused the public exposure.
Because the insecure configuration had been introduced through the bucket policy, I located the PutBucketPolicy event and reviewed the timestamp, the identity responsible for the API call, and the affected resource.
The event confirmed the policy change and made it possible to associate the modification with the identity that performed the API call.
Alerting with EventBridge + SNS
In addition to the Access Analyzer detection, I configured an alerting workflow for changes related to public S3 access.
A CloudTrail trail recorded management events, EventBridge filtered relevant S3 configuration changes, and SNS sent an email notification.
EventBridge rule configured to capture CloudTrail events related to bucket policy and Block Public Access changes.
SNS notification generated after a PutBucketPolicy event, including the API action, event time, identity, and affected bucket details.
The notification exposed the API action, event time, and context of the recorded change.
Remediation and validation
To remediate the exposure:
- I re-enabled Block Public Access;
- I removed the public bucket policy.
After remediation, I validated that the bucket no longer allowed public read access and that the insecure configuration had been removed.
Post-remediation validation: Block Public Access is enabled and the public bucket policy has been removed.
Conclusion
The lab integrated AWS-native services to detect, investigate, and remediate public exposure in S3.
IAM Access Analyzer identified the exposure, CloudTrail provided the change history and responsible identity, and EventBridge + SNS converted the configuration change into a notification.
After remediation, I validated that Block Public Access was enabled again and that the public bucket policy had been removed.