AWS Bucket Block Public Access Weakened

 1title: AWS Bucket Block Public Access Weakened
 2id: ab18a523-e093-4ac6-8303-8c47431f4fca
 3status: experimental
 4description: |
 5    Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
 6    Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.    
 7references:
 8    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
 9    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html
10author: Shoban Chiddarth
11date: 2026-10-21
12tags:
13    - attack.defense-impairment
14    - attack.t1686.001
15logsource:
16    product: aws
17    service: cloudtrail
18detection:
19    selection_event_name:
20        eventSource: 's3.amazonaws.com'
21        eventName: 'PutBucketPublicAccessBlock'
22    selection_weaken_restrict_public_buckets:
23        requestParameters.PublicAccessBlockConfiguration.RestrictPublicBuckets: 'false'
24    selection_weaken_block_public_acls:
25        requestParameters.PublicAccessBlockConfiguration.BlockPublicAcls: 'false'
26    selection_weaken_block_public_policy:
27        requestParameters.PublicAccessBlockConfiguration.BlockPublicPolicy: 'false'
28    selection_weaken_ignore_public_acls:
29        requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls: 'false'
30    selection_status_success:
31        errorCode: 'Success'
32    selection_status_null:
33        errorCode: null
34    condition: selection_event_name and 1 of selection_weaken_* and 1 of selection_status_*
35falsepositives:
36    - Administrators intentionally modifying Block Public Access settings to support a legitimate application or public bucket configuration.
37level: medium