---
title: >-
  Publicly accessible S3 bucket with sensitive data is vulnerable to public data
  theft
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Publicly accessible S3 bucket with
  sensitive data is vulnerable to public data theft
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Publicly accessible S3 bucket with sensitive data is vulnerable to public data theft

## Description{% #description %}

A publicly accessible S3 bucket containing sensitive data is vulnerable to public data theft. The bucket's public accessibility, combined with the presence of sensitive data and lack of SSE-KMS encryption, means an external attacker can directly access and exfiltrate confidential information without authentication. Sensitive data exposed in this manner could include personally identifiable information (PII), credentials, financial records, or proprietary business data, leading to regulatory violations, reputational damage, and financial loss. For more details on how sensitive data is detected, see the [Cloud Storage Scanning](https://docs.datadoghq.com/security/cloud_security_management/setup/agentless_scanning.md#cloud-storage-scanning).

## Remediation{% #remediation %}

1. Enable [S3 Block Public Access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) at both the account and bucket level to prevent unintended public exposure.
1. Enable [SSE-KMS encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html) to add a layer of protection in case access controls are misconfigured.