AWS Bucket Block Public Access Weakened

Title: AWS Bucket Block Public Access Weakened
Status: experimental
Description:Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs. Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
References:
  -https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
  -https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html
Author: Shoban Chiddarth
Date: 2026-10-21
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.001'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection_event_name:
    eventSource: 's3.amazonaws.com'
    eventName: 'PutBucketPublicAccessBlock'
  selection_weaken_restrict_public_buckets:
    requestParameters.PublicAccessBlockConfiguration.RestrictPublicBuckets: 'false'
  selection_weaken_block_public_acls:
    requestParameters.PublicAccessBlockConfiguration.BlockPublicAcls: 'false'
  selection_weaken_block_public_policy:
    requestParameters.PublicAccessBlockConfiguration.BlockPublicPolicy: 'false'
  selection_weaken_ignore_public_acls:
    requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls: 'false'
  selection_status_success:
    errorCode: 'Success'
  selection_status_null:
    errorCode: 'None'
  condition:selection_event_name and 1 of selection_weaken_* and 1 of selection_status_*
Falsepositives:
  -Administrators intentionally modifying Block Public Access settings to support a legitimate application or public bucket configuration.
Level: medium