An EC2 instance attempted to enumerate S3 bucket
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect when an EC2 instance makes an API call to AWS to list all of the S3 Buckets.
Strategy
This rule lets you monitor CloudTrail to detect a ListBuckets API call with the session name prefixed with i-. A session name prefixed with i- typically indicates that it is an EC2 instance using an Instance Profile to communicate with other AWS services, which is a common attacker technique to see the full list of S3 buckets in your AWS account.
Triage and response
Determine if the EC2 instance should be making this API call.
- If not a legitimate user/application, rotate the credentials, verify what else may have been accessed and open an investigation into how this instance was compromised.
- If a legitimate user/application on the EC2 instance is making the
ListBuckets API call, consider whether this API call is really needed.
Changelog
18 March 2022 - Updated rule severity and rule name.
