---
title: "Exposed AWS S3 bucket"
canonical: "https://kb.cynergy.app/space/MD/899416176/Exposed%20AWS%20S3%20bucket"
format: markdown
---
**Description **

Amazon S3 buckets are used to store data in AWS. The S3 buckets have several configurable properties. The owner of the AWS account can define to publicly share the content of the S3 bucket, or alternatively use it as private storage. 

Bucket policies and bucket or object ACLs allow you to configure them for access to anyone. Many admins, neglecting this, leave their S3 resources open without knowing they are doing so. Of course, AWS has prompts and warnings that emphasize this point and try to prevent this type of lapse in security, but that hasn’t prevented many occurrences of sensitive data being leaked through this simple error.

In some cases, S3 buckets that should have been set to be private, are misconfigured and allow access and modification by internet users. 

**Hacker's View**

As a hacker, I can run scanners to detect open and misconfigured S3 buckets using tools like [S3-leaks](https://github.com/nagwww/s3-leaks), [S3Scanner](https://github.com/sa7mon/S3Scanner), or [s3-inspector](https://github.com/clario-tech/s3-inspector) or use platforms like [Grayhatwarfare](https://buckets.grayhatwarfare.com/) once I have identified a bucket that is accessible and which contains interesting/sensitive information. I would download the information and try extorting the organization. If the information contains secret keys or other information that may help me to get even stronger access to the organization’s assets. 

Manually test access to a bucket using the following convention:

- [http://s3.amazonaws.com/[bucket_name]/](http://s3.amazonaws.com/%5Bbucket_name%5D/)
- [http://[bucket_name].s3.amazonaws.com/](https://community.rapid7.com/%5Bbucket_name%5D.s3.amazonaws.com)

**Mitigation**

Change the S3 bucket access policy based on the below references per AWS recommendation provider.   
o make sure your files and Amazon S3 buckets are secure, follow these best practices:

- **Monitor your S3 resources:** Monitor your resources using [AWS CloudTrail logs](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-getting-started.html), [S3 server access logging](https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html), [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html), [AWS Identity and Access Management (IAM) Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html), [Amazon Macie](https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html), Amazon CloudWatch, or [AWS Trusted Advisor's S3 bucket permissions check](https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/#security).
- **Use encryption to protect your data:** Amazon S3 supports encryption during transmission, [server-side encryption (SSE)](https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html), and [client-side encryption](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html).

<u>Manual Mitigation</u>

<details>
<summary>Restrict access to your S3 resources: When using AWS, restrict access to your resources to the people that absolutely need it. Follow the principle of least privilege.</summary>

##### Terraform

- **Resource**: aws_s3_bucket.data
- **Argument**: acl

```
resource "aws_s3_bucket" "data" {
    ...
  bucket        = "${local.resource_prefix.value}-data"
-  acl           = "public-read"
+  acl           = "private"
}

```

##### CloudFormation

- **Resource**: AWS::S3::Bucket.data
- **Argument**: Properties.AccessControl

##### YAML

```
Type: AWS::S3::Bucket
    Properties:
        ...
-     AccessControl: PublicReadWrite / PublicRead
```
</details>

<details>
<summary>This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access. We recommend you set S3 Bucket BlockPublicAcls to True.</summary>

##### Terraform

#####   
Resource: aws_s3_bucket_public_access_block  
Argument: block_public_acls

aws_s3_bucket_public_access_block.artifacts.tf

```
resource "aws_s3_bucket_public_access_block" "artifacts" {
  count  = var.bucketname == "" ? 1 : 0
  bucket = aws_s3_bucket.artifacts[0].id
  
+ block_public_acls   = true
  block_public_policy = true
  restrict_public_buckets = true
  ignore_public_acls=true
}
```
</details>

**Cynergy’s View**

Cynergy detects the publicly exposed and open S3 buckets and notifies to the client regarding the exposure. In addition, Cynergy identifies all the exposed files in the 

**Reference**

AWS - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html) 

CSA - [https://cloudsecurityalliance.org/blog/2020/06/18/3-big-amazon-s3-vulnerabilities-you-may-be-missing/](https://cloudsecurityalliance.org/blog/2020/06/18/3-big-amazon-s3-vulnerabilities-you-may-be-missing/) 

Portswigger - [https://portswigger.net/daily-swig/insecure-amazon-s3-bucket-exposed-personal-data-on-500-000-ghanaian-graduates](https://portswigger.net/daily-swig/insecure-amazon-s3-bucket-exposed-personal-data-on-500-000-ghanaian-graduates) 

Infosecwriteups- [https://infosecwriteups.com/from-aws-s3-misconfiguration-to-sensitive-data-exposure-784f37a30bf9](https://infosecwriteups.com/from-aws-s3-misconfiguration-to-sensitive-data-exposure-784f37a30bf9)