Automate detection and remediation of public S3 buckets by combining AWS Config managed rules, GuardDuty S3 protection, IAM Access Analyzer, and event‑driven Lambda fixes.
1. Enable AWS Config
- Activate the managed rules s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited.
- Set remediation mode to AUTOMATIC so non‑compliant resources are flagged instantly.
2. Turn on GuardDuty S3 protection
- In the GuardDuty console, enable S3 data events; findings appear as UnauthorizedAccess:S3/AnonymousAccess.
3. Validate IAM policies
- Run Access Analyzer aws accessanalyzer list-analyzers and aws accessanalyzer start-policy-generation to catch overly permissive bucket policies.
4. Enforce IaC policies
- Add a CloudFormation Guard rule S3_BUCKET_PUBLIC_ACCESS or OPA policy in CI pipelines to reject PublicRead/PublicReadWrite ACLs.
5. Remediate via EventBridge + Lambda
```python
import boto3, json
s3 = boto3.client('s3')
def lambda_handler(event, context):
bucket = event['detail']['resourceId'].split('/')[-1]
s3.put_public_access_block(
Bucket=bucket,
PublicAccessBlockConfiguration={
'BlockPublicAcls': True,
'IgnorePublicAcls': True,
'BlockPublicPolicy': True,
'RestrictPublicBuckets': True
}
)
# Remove any public ACLs
s3.put_bucket_acl(Bucket=bucket, ACL='private')
return {'status': 'remediated'}
```
6. Nightly drift scan
- Run Cloud Custodian policy s3-public-access.yml or Prowler aws_s3_5 to catch buckets that slipped through CI.
7. SIEM integration
- Forward Config and GuardDuty findings to Splunk/Sentinel for ticketing and trend analysis.
Tool comparison
| Tool | Real‑time detection | IaC enforcement | Cost |
|------|--------------------|----------------|------|
| AWS Config | ✅ | ✅ (via Guardrails) | Low |
| Cloud Custodian | ❌ (batch) | ✅ (policy files) | Free |
| Prisma Cloud | ✅ | ✅ (CSPM) | Enterprise |
Gotcha: Public access can be granted through cross‑account bucket policies that reference external principals; ensure your Analyzer and Config rules include account-id:* principals, otherwise remediation will miss these vectors.