Automatically scan for public Amazon S3 buckets and block public access
Storage Blog
This article discusses an automated solution to detect and block public Amazon S3 buckets in your AWS account, unless you explicitly want them to be public. The solution leverages AWS Security Hub, Amazon EventBridge, AWS Lambda, and Amazon CloudWatch.
Specifically, the article covers:
- Setting up AWS Security Hub to detect public S3 buckets using the AWS Foundational Security Best Practices standard
- Creating an AWS Lambda function to block public access to S3 buckets based on resource tags
- Configuring an Amazon EventBridge rule triggered by Security Hub findings, with the Lambda function and a CloudWatch log group as targets
- Setting up CloudWatch metrics and alarms to send notifications when public S3 buckets are detected
- Conclusion and links to additional resources
The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.
Related articles
The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.