LoFP LoFP / administrators intentionally modifying block public access settings to support a legitimate application or public bucket configuration.

Techniques

Sample rules

AWS Bucket Block Public Access Weakened

Description

Detects the weakening of “Block Public Access” setting of S3 buckets in CloudTrail logs. Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.

Detection logic

condition: selection_event_name and 1 of selection_weaken_* and 1 of selection_status_*
selection_event_name:
  eventName: PutBucketPublicAccessBlock
  eventSource: s3.amazonaws.com
selection_status_null:
  errorCode: null
selection_status_success:
  errorCode: Success
selection_weaken_block_public_acls:
  requestParameters.PublicAccessBlockConfiguration.BlockPublicAcls: 'false'
selection_weaken_block_public_policy:
  requestParameters.PublicAccessBlockConfiguration.BlockPublicPolicy: 'false'
selection_weaken_ignore_public_acls:
  requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls: 'false'
selection_weaken_restrict_public_buckets:
  requestParameters.PublicAccessBlockConfiguration.RestrictPublicBuckets: 'false'