-
AWS S3 Bucket ACL Modified to Allow Public Access by New Identity
Detects a principal modifying an S3 bucket ACL to grant public read or write access that has not been observed doing so within the history window, using canned ACLs such as public-read or public-read-write. ACL-based public access is a distinct API path (PutBucketAcl) that can bypass some Block Public Access controls. Monitoring for new identities performing this change helps surface freshly compromised credentials being used to stage data for exfiltration or inadvertently expose sensitive content.
Read More -
AWS S3 Unauthenticated Bucket Access by Rare Source
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: Amazon S3 Use Case: Asset Visibility Resources: Investigation Guide Tactic: Collection Noise: High Performance: Normal Profile: Aggressive Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS S3 ·Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify --no-sign-request in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a New Terms rule, which means it will trigger for each unique combination of the source.address and targeted bucket name that has not been seen making this API request.
Read More