---
title: >-
  Publicly writable S3 bucket is vulnerable to public malware hosting or
  resource theft
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Publicly writable S3 bucket is
  vulnerable to public malware hosting or resource theft
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Publicly writable S3 bucket is vulnerable to public malware hosting or resource theft

## Description{% #description %}

A publicly writable S3 bucket is vulnerable to malware hosting or resource theft. The bucket's policy or ACLs allow public write access, enabling an external attacker to upload arbitrary files without authentication. Threat actors exploit this to host malware, phishing pages, or other illicit content using the victim's infrastructure, benefiting from trusted IP space that is difficult to identify and block. This results in financial loss from unauthorized storage consumption and reputational damage if the organization's resources are associated with malicious activity.

## Remediation{% #remediation %}

1. Enable [S3 Block Public Access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) at both the account and bucket level to prevent unauthorized public write access.
1. Review and restrict [bucket ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html) to remove public write permissions.
1. Review and restrict [bucket policies](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html) to remove public write access statements.