AWS S3 Bucket ACL Modified to Allow Public Access by New Identity

Last updated 5 days ago on 2026-07-27

Created 5 days ago on 2026-07-27

About

Detects a principal modifying an S3 bucket ACL to grant public read or write access that has not been observed doing so within the history window, using canned ACLs such as public-read or public-read-write. ACL-based public access is a distinct API path (PutBucketAcl) that can bypass some Block Public Access controls. Monitoring for new identities performing this change helps surface freshly compromised credentials being used to stage data for exfiltration or inadvertently expose sensitive content.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: Amazon S3Use Case: Threat DetectionTactic: CollectionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Cloud Storage (T1530)(external, opens in a new tab or window)

False Positive Examples

Static website hosting configurations may intentionally use a public-read ACL on S3 buckets that serve web content. Validate that the target bucket is a known public-facing asset and that the change was authorized. Consider adding exclusions for specific bucket names used for static hosting.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: "PutBucketAcl"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and aws.cloudtrail.flattened.request_parameters.x-amz-acl: ("public-read" or "public-read-write")
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)

Install detection rules in Elastic Security

Detect AWS S3 Bucket ACL Modified to Allow Public Access by New Identity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).