Publicly accessible S3 bucket with sensitive data is vulnerable to public data theft

s3
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

A publicly accessible S3 bucket containing sensitive data is vulnerable to public data theft. The bucket’s public accessibility, combined with the presence of sensitive data and lack of SSE-KMS encryption, means an external attacker can directly access and exfiltrate confidential information without authentication. Sensitive data exposed in this manner could include personally identifiable information (PII), credentials, financial records, or proprietary business data, leading to regulatory violations, reputational damage, and financial loss. For more details on how sensitive data is detected, see the Cloud Storage Scanning.

Remediation

  1. Enable S3 Block Public Access at both the account and bucket level to prevent unintended public exposure.
  2. Enable SSE-KMS encryption to add a layer of protection in case access controls are misconfigured.