Analytics BIOC
Low
✕
AWS S3 bucket was exposed to public access
AWS S3 bucket was publicly shared.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses (T1562)
Detector tags: Cloud Data Asset Exfiltration Cloud Data Asset Public Exposure Data Detection & Response
Attacker's goals:
The attacker wants to maintain indirect control over the resource. The attacker intends to allow public access, making it harder to detect future activity. Attackers are constantly monitoring for public assets to steal sensitive information.
Investigative actions:
Check if the identity intended to change the state of the bucket or object to public. Review the bucket ACL policy. Restrict permissions for the identity if needed.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- AWS S3 bucket was exposed to public access by admin cloud identity Informational (parent: Low)
- AWS S3 bucket was exposed to public access containing sensitive information High (parent: Low)