AWS S3 Public Access Block Removed

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•3•0•48

Detects when the S3 Public Access Block configuration has been removed from an AWS S3 bucket or an entire AWS account. This action can significantly increase the risk of public exposure for S3 objects, potentially leading to data breaches or unauthorized access. The rule specifically looks for `DeleteAccountPublicAccessBlock`, `DeleteBucketPublicAccessBlock` events, or `PutBucketPublicAccessBlock`/`PutAccountPublicAccessBlock` events where all public access blocking attributes (`RestrictPublicBuckets`, `BlockPublicPolicy`, `BlockPublicAcls`, `IgnorePublicAcls`) are set to false or are missing, indicating a removal or weakening of the public access block.