AWS S3 Buckets Enumerated
Rapport de recherche Datadog : Bilan sur l'adoption de l'informatique sans serveur Rapport : Bilan sur l'adoption de l'informatique sans serveur
<  Back to rules search

AWS S3 Buckets Enumerated






Set up the cloudtrail integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.



Detect when an EC2 instance makes an API call to AWS to list all of the S3 Buckets.


This rule lets you monitor CloudTrail to detect a ListBuckets API call with the session name prefixed with i-. A session name prefixed with i- typically indicates that it is an EC2 instance using an Instance Profile to communicate with other AWS services, which is a common attacker technique to see the full list of S3 buckets in your AWS account. Determine if the EC2 instance should be making this API call. * If not, rotate the credentials, verify what else may have been accessed and open an investigation into how this instance was compromised. * If the application or legitimate user on the EC2 instance is making the ListBuckets API call, consider whether this API call is really needed.

Sur cette page