---
title: >-
  S3 bucket with sensitive data is vulnerable to ransomware or deletion via
  public access
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 bucket with sensitive data is
  vulnerable to ransomware or deletion via public access
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# S3 bucket with sensitive data is vulnerable to ransomware or deletion via public access

## Description{% #description %}

An S3 bucket containing sensitive data is publicly accessible and lacks protective configurations against ransomware or data destruction attacks. The bucket's policy or ACLs allow public write access, versioning is not enabled, Object Lock default retention is not configured, and MFA Delete is not enabled. This means an external attacker can directly overwrite or delete bucket contents without authentication. This attack path enables ransomware-style attacks where data is deleted or overwritten with encrypted versions and held for ransom. For more details on how sensitive data is detected, see the [Cloud Storage Scanning](https://docs.datadoghq.com/security/cloud_security_management/setup/agentless_scanning.md#cloud-storage-scanning).

## Remediation{% #remediation %}

1. Enable [S3 Block Public Access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) at both the account and bucket level to prevent unauthorized public write access.
1. Enable [S3 versioning](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html) to maintain previous versions of objects, allowing recovery from accidental or malicious deletions.
1. Enable [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) with default retention to automatically protect new objects from being deleted or overwritten.
1. Enable [MFA Delete](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html) to require multi-factor authentication for permanent deletion of object versions.