LoFP / static website hosting configurations may intentionally use a public-read acl on s3 buckets that serve web content. validate that the target bucket is a known public-facing asset and that the change was authorized. consider adding exclusions for specific bucket names used for static hosting.

Techniques

• T1530

Sample rules

AWS S3 Bucket ACL Modified to Allow Public Access by New Identity

• source: elastic
• technicques:
  • T1530

Description

Detects a principal modifying an S3 bucket ACL to grant public read or write access that has not been observed doing so within the history window, using canned ACLs such as public-read or public-read-write. ACL-based public access is a distinct API path (PutBucketAcl) that can bypass some Block Public Access controls. Monitoring for new identities performing this change helps surface freshly compromised credentials being used to stage data for exfiltration or inadvertently expose sensitive content.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: "PutBucketAcl"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and aws.cloudtrail.flattened.request_parameters.x-amz-acl: ("public-read" or "public-read-write")
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)