Publicly writable S3 bucket is vulnerable to public malware hosting or resource theft

s3

Description

A publicly writable S3 bucket is vulnerable to malware hosting or resource theft. The bucket’s policy or ACLs allow public write access, enabling an external attacker to upload arbitrary files without authentication. Threat actors exploit this to host malware, phishing pages, or other illicit content using the victim’s infrastructure, benefiting from trusted IP space that is difficult to identify and block. This results in financial loss from unauthorized storage consumption and reputational damage if the organization’s resources are associated with malicious activity.

Remediation

  1. Enable S3 Block Public Access at both the account and bucket level to prevent unauthorized public write access.
  2. Review and restrict bucket ACLs to remove public write permissions.
  3. Review and restrict bucket policies to remove public write access statements.