Publicly accessible S3 bucket with sensitive data is vulnerable to public data theft

s3

Description

A publicly accessible S3 bucket containing sensitive data is vulnerable to public data theft. The bucket’s public accessibility, combined with the presence of sensitive data and lack of SSE-KMS encryption, means an external attacker can directly access and exfiltrate confidential information without authentication. Sensitive data exposed in this manner could include personally identifiable information (PII), credentials, financial records, or proprietary business data, leading to regulatory violations, reputational damage, and financial loss. For more details on how sensitive data is detected, see the Cloud Storage Scanning.

Remediation

  1. Enable S3 Block Public Access at both the account and bucket level to prevent unintended public exposure.
  2. Enable SSE-KMS encryption to add a layer of protection in case access controls are misconfigured.