AWS S3 Bucket Policy Added to Allow Public Access

Description

Detects when an Amazon S3 bucket policy is modified to grant public access using a wildcard (Principal:"*") statement. This rule analyzes PutBucketPolicy events that include both Effect=Allow and Principal:"*" in the request parameters, indicating that permissions were extended to all identities, potentially making the bucket or its contents publicly accessible. Publicly exposing an S3 bucket is one of the most common causes of sensitive data leaks in AWS environments. Adversaries or misconfigurations can leverage this exposure to exfiltrate data, host malicious content, or collect credentials and logs left in open storage.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: IaaS Office Suite SaaS
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source category: event_index

Known benign triggers

This rule does not differentiate by itself whether the same policy also includes Deny statements that restrict public access. If a policy includes both Effect=Allow and Effect=Deny with Principal:"*", this rule may still trigger. Such cases should be manually analyzed to verify whether the Deny statement effectively negates the public exposure.

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html	Product documentation	2
stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.s3-backdoor-bucket-policy/	Unclassified	2

Detection rules

AWS S3 Bucket Policy Added to Allow Public Access

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules