[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG6RKJM30QXKTAJY0WPJSJ":3,"skill-same:01M6AG6RKJM30QXKTAJY0WPJSJ":131},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":73,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":77,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6AG6RKJM30QXKTAJY0WPJSJ","remediating-s3-bucket-misconfiguration",null,"Provides step-by-step procedures for remediating Amazon S3 bucket misconfigurations that expose sensitive data: enabling S3 Block Public Access, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and deploying automated remediation with AWS Config and Lambda. Use when AWS Config or Security Hub flags public or unencrypted S3 buckets, or preparing audit evidence for storage security controls.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fremediating-s3-bucket-misconfiguration\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"remediating s3 bucket misconfiguration","s3","misconfiguration","remediation","aws-config","public-access-block","bucket-misconfiguration","s3-security","t1078","public-access","lambda","security","encryption","data","cloud-security","audit","logging","config","storage","cybersecurity","2026-11-10 10:12:30",false,"---\nname: remediating-s3-bucket-misconfiguration\ndescription: 'Provides step-by-step procedures for remediating Amazon S3 bucket\n  misconfigurations that expose sensitive data: enabling S3 Block Public Access,\n  auditing bucket policies and ACLs, enforcing encryption, configuring access logging,\n  and deploying automated remediation with AWS Config and Lambda. Use when AWS Config\n  or Security Hub flags public or unencrypted S3 buckets, or preparing audit evidence\n  for storage security controls.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- s3-security\n- bucket-misconfiguration\n- data-exposure\n- public-access-block\n- aws-config\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1573\n---\n\n# Remediating S3 Bucket Misconfiguration\n\n## When to Use\n\n- When AWS Config or Security Hub reports S3 buckets with public access or missing encryption\n- When a security scan reveals S3 bucket policies granting access to Principal \"*\" (everyone)\n- When preparing for a data protection audit requiring evidence of storage security controls\n- When responding to a data exposure incident involving publicly accessible S3 objects\n- When establishing preventive controls for new S3 bucket creation across an AWS Organization\n\n**Do not use** for Azure Blob Storage or GCP Cloud Storage misconfigurations, for S3 data classification (see implementing-cloud-dlp-policy), or for S3 access pattern analysis unrelated to security.\n\n## Prerequisites\n\n- AWS account with S3 administrative permissions (s3:*, s3-outposts:*)\n- AWS Config enabled to evaluate S3 resource compliance\n- AWS CloudTrail logging S3 data events for access auditing\n- Macie enabled for sensitive data discovery in S3 buckets\n\n## Workflow\n\n### Step 1: Identify All Public and Misconfigured Buckets\n\nUse multiple detection methods to identify S3 buckets with public access. Rely on AWS Config rules, S3 Access Analyzer, and Macie rather than manual inspection.\n\n```bash\n# Enable S3 Access Analyzer for external access detection\naws accessanalyzer create-analyzer \\\n  --analyzer-name s3-analyzer \\\n  --type ACCOUNT\n\n# List all S3 buckets with public access indicators\naws s3api list-buckets --query 'Buckets[*].Name' --output text | while read bucket; do\n  public_status=$(aws s3api get-public-access-block --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  if [ $? -ne 0 ]; then\n    echo \"NO PUBLIC ACCESS BLOCK: $bucket\"\n  fi\ndone\n\n# Check bucket policies for public access grants\naws s3api list-buckets --query 'Buckets[*].Name' --output text | while read bucket; do\n  policy=$(aws s3api get-bucket-policy --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  if echo \"$policy\" | grep -q '\"Principal\":\"*\"' 2>\u002Fdev\u002Fnull; then\n    echo \"PUBLIC POLICY DETECTED: $bucket\"\n  fi\ndone\n\n# Use AWS Config to find non-compliant buckets\naws configservice get-compliance-details-by-config-rule \\\n  --config-rule-name s3-bucket-public-read-prohibited \\\n  --compliance-types NON_COMPLIANT \\\n  --query 'EvaluationResults[*].EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId'\n```\n\n### Step 2: Enable S3 Block Public Access at Account Level\n\nApply the four Block Public Access settings at the AWS account level as a safety net. This prevents any bucket in the account from being made public, regardless of individual bucket policies or ACLs.\n\n```bash\n# Enable account-level Block Public Access (all four settings)\naws s3control put-public-access-block \\\n  --account-id 123456789012 \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n\n# Verify account-level settings\naws s3control get-public-access-block --account-id 123456789012\n\n# Enable at bucket level for defense in depth\naws s3api put-public-access-block \\\n  --bucket production-data-bucket \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n```\n\n### Step 3: Audit and Remediate Bucket Policies and ACLs\n\nReview all bucket policies for overly permissive Principal statements and remove legacy ACLs. Enforce bucket ownership controls to disable ACLs entirely.\n\n```bash\n# Remove a public bucket policy\naws s3api delete-bucket-policy --bucket exposed-bucket\n\n# Replace with a restrictive policy\naws s3api put-bucket-policy --bucket exposed-bucket --policy '{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"DenyUnencryptedTransport\",\n      \"Effect\": \"Deny\",\n      \"Principal\": \"*\",\n      \"Action\": \"s3:*\",\n      \"Resource\": [\n        \"arn:aws:s3:::exposed-bucket\",\n        \"arn:aws:s3:::exposed-bucket\u002F*\"\n      ],\n      \"Condition\": {\n        \"Bool\": {\"aws:SecureTransport\": \"false\"}\n      }\n    },\n    {\n      \"Sid\": \"AllowOnlyVPCEndpoint\",\n      \"Effect\": \"Deny\",\n      \"Principal\": \"*\",\n      \"Action\": \"s3:*\",\n      \"Resource\": [\n        \"arn:aws:s3:::exposed-bucket\",\n        \"arn:aws:s3:::exposed-bucket\u002F*\"\n      ],\n      \"Condition\": {\n        \"StringNotEquals\": {\"aws:SourceVpce\": \"vpce-0abc123def456\"}\n      }\n    }\n  ]\n}'\n\n# Enforce bucket owner for all objects (disable ACLs)\naws s3api put-bucket-ownership-controls --bucket exposed-bucket \\\n  --ownership-controls '{\"Rules\": [{\"ObjectOwnership\": \"BucketOwnerEnforced\"}]}'\n```\n\n### Step 4: Enforce Default Encryption\n\nEnable default server-side encryption with AWS KMS or AES-256 for all buckets. Add a bucket policy denying unencrypted object uploads.\n\n```bash\n# Enable default KMS encryption\naws s3api put-bucket-encryption --bucket production-data-bucket \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\n      \"ApplyServerSideEncryptionByDefault\": {\n        \"SSEAlgorithm\": \"aws:kms\",\n        \"KMSMasterKeyID\": \"arn:aws:kms:us-east-1:123456789012:key\u002Fkey-id\"\n      },\n      \"BucketKeyEnabled\": true\n    }]\n  }'\n\n# Deny unencrypted uploads via bucket policy\naws s3api put-bucket-policy --bucket production-data-bucket --policy '{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Sid\": \"DenyUnencryptedUploads\",\n    \"Effect\": \"Deny\",\n    \"Principal\": \"*\",\n    \"Action\": \"s3:PutObject\",\n    \"Resource\": \"arn:aws:s3:::production-data-bucket\u002F*\",\n    \"Condition\": {\n      \"StringNotEquals\": {\"s3:x-amz-server-side-encryption\": [\"aws:kms\", \"AES256\"]}\n    }\n  }]\n}'\n```\n\n### Step 5: Enable Access Logging and Monitoring\n\nConfigure S3 server access logging and CloudTrail data events to track all object-level operations. Set up EventBridge rules to alert on suspicious access patterns.\n\n```bash\n# Enable server access logging\naws s3api put-bucket-logging --bucket production-data-bucket \\\n  --bucket-logging-status '{\n    \"LoggingEnabled\": {\n      \"TargetBucket\": \"s3-access-logs-bucket\",\n      \"TargetPrefix\": \"production-data-bucket\u002F\"\n    }\n  }'\n\n# Enable CloudTrail S3 data events\naws cloudtrail put-event-selectors --trail-name management-trail \\\n  --event-selectors '[{\n    \"ReadWriteType\": \"All\",\n    \"DataResources\": [{\n      \"Type\": \"AWS::S3::Object\",\n      \"Values\": [\"arn:aws:s3:::production-data-bucket\u002F\"]\n    }]\n  }]'\n```\n\n### Step 6: Deploy Preventive Controls with SCP and Config\n\nUse Service Control Policies to prevent disabling Block Public Access across the organization. Deploy AWS Config rules with auto-remediation.\n\n```bash\n# SCP preventing Block Public Access removal\naws organizations create-policy \\\n  --name PreventS3PublicAccess \\\n  --type SERVICE_CONTROL_POLICY \\\n  --content '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Sid\": \"DenyRemovePublicAccessBlock\",\n      \"Effect\": \"Deny\",\n      \"Action\": [\n        \"s3:PutBucketPublicAccessBlock\",\n        \"s3:PutAccountPublicAccessBlock\"\n      ],\n      \"Resource\": \"*\",\n      \"Condition\": {\n        \"StringNotLike\": {\"aws:PrincipalArn\": \"arn:aws:iam::*:role\u002FSecurityAdmin\"}\n      }\n    }]\n  }'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| S3 Block Public Access | Four account-level and bucket-level settings that override any policy or ACL granting public access to S3 resources |\n| Bucket Policy | JSON-based resource policy attached to an S3 bucket defining who can access what objects under which conditions |\n| ACL (Access Control List) | Legacy S3 access mechanism that grants permissions at the bucket or object level; should be disabled via BucketOwnerEnforced |\n| BucketOwnerEnforced | Ownership control setting that disables all ACLs on a bucket, making the bucket owner the sole authority for access control |\n| Server-Side Encryption | Automatic encryption of objects at rest using AES-256 (SSE-S3), AWS KMS (SSE-KMS), or customer-provided keys (SSE-C) |\n| VPC Endpoint | Private connection between a VPC and S3 that restricts bucket access to traffic originating from within the VPC |\n| S3 Access Analyzer | IAM Access Analyzer capability that identifies S3 buckets shared with external entities outside the account or organization |\n\n## Tools & Systems\n\n- **AWS Config**: Evaluates S3 bucket compliance against managed rules and triggers auto-remediation for non-compliant resources\n- **Amazon Macie**: Discovers and classifies sensitive data in S3 buckets to identify which misconfigurations pose the highest data exposure risk\n- **IAM Access Analyzer**: Identifies S3 buckets with policies or ACLs that grant access to external principals\n- **S3 Storage Lens**: Provides organization-wide visibility into S3 usage patterns, access metrics, and security anomalies\n- **Prowler**: Open-source tool that checks S3 security configurations against CIS benchmarks and best practices\n\n## Common Scenarios\n\n### Scenario: Data Breach from Publicly Readable S3 Bucket Containing PII\n\n**Context**: A security researcher reports that an S3 bucket containing 273,000 bank transfer PDFs is publicly readable. The bucket was created by a developer who needed to share files with an external partner and set the ACL to public-read.\n\n**Approach**:\n1. Immediately enable Block Public Access on the specific bucket to stop the exposure\n2. Revoke all public ACLs by setting BucketOwnerEnforced ownership controls\n3. Audit CloudTrail and S3 access logs to determine which IP addresses accessed the exposed objects\n4. Run Macie on the bucket to classify the types of PII exposed and assess regulatory notification requirements\n5. Enable account-level Block Public Access to prevent recurrence across all buckets\n6. Deploy an SCP preventing any principal except SecurityAdmin from modifying Block Public Access settings\n7. Create a pre-signed URL mechanism or S3 Access Point for the legitimate partner sharing use case\n\n**Pitfalls**: Enabling Block Public Access without notifying the team that set up the public access breaks their workflow. Not running access log analysis before remediation loses evidence of who accessed the exposed data.\n\n## Output Format\n\n```\nS3 Bucket Security Remediation Report\n=======================================\nAccount: 123456789012\nAssessment Date: 2025-02-23\nBuckets Scanned: 156\n\nACCOUNT-LEVEL CONTROLS:\n  Block Public Access: ENABLED (all four settings)\n  SCP Preventing Removal: DEPLOYED\n\nCRITICAL FINDINGS (Remediated):\n  [S3-001] production-uploads - Public READ via ACL\n    Status: REMEDIATED - BucketOwnerEnforced applied\n    Objects Exposed: 273,412\n    Duration of Exposure: 47 days\n    Unique External IPs Accessed: 1,247\n\n  [S3-002] analytics-export - Public bucket policy (Principal: *)\n    Status: REMEDIATED - Policy replaced with VPC endpoint restriction\n    Sensitive Data (Macie): 12,400 objects with PII detected\n\nHIGH FINDINGS:\n  [S3-003] 14 buckets missing default encryption\n    Status: REMEDIATED - KMS encryption enabled\n  [S3-004] 8 buckets without server access logging\n    Status: REMEDIATED - Logging enabled to centralized log bucket\n\nSUMMARY:\n  Buckets Remediated: 24\u002F156\n  Encryption Coverage: 100%\n  Access Logging Coverage: 100%\n  Block Public Access: 156\u002F156 buckets\n```\n","# Remediating S3 Bucket Misconfiguration\n\n## When to Use\n\n- When AWS Config or Security Hub reports S3 buckets with public access or missing encryption\n- When a security scan reveals S3 bucket policies granting access to Principal \"*\" (everyone)\n- When preparing for a data protection audit requiring evidence of storage security controls\n- When responding to a data exposure incident involving publicly accessible S3 objects\n- When establishing preventive controls for new S3 bucket creation across an AWS Organization\n\n**Do not use** for Azure Blob Storage or GCP Cloud Storage misconfigurations, for S3 data classification (see implementing-cloud-dlp-policy), or for S3 access pattern analysis unrelated to security.\n\n## Prerequisites\n\n- AWS account with S3 administrative permissions (s3:*, s3-outposts:*)\n- AWS Config enabled to evaluate S3 resource compliance\n- AWS CloudTrail logging S3 data events for access auditing\n- Macie enabled for sensitive data discovery in S3 buckets\n\n## Workflow\n\n### Step 1: Identify All Public and Misconfigured Buckets\n\nUse multiple detection methods to identify S3 buckets with public access. Rely on AWS Config rules, S3 Access Analyzer, and Macie rather than manual inspection.\n\n```bash\n# Enable S3 Access Analyzer for external access detection\naws accessanalyzer create-analyzer \\\n  --analyzer-name s3-analyzer \\\n  --type ACCOUNT\n\n# List all S3 buckets with public access indicators\naws s3api list-buckets --query 'Buckets[*].Name' --output text | while read bucket; do\n  public_status=$(aws s3api get-public-access-block --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  if [ $? -ne 0 ]; then\n    echo \"NO PUBLIC ACCESS BLOCK: $bucket\"\n  fi\ndone\n\n# Check bucket policies for public access grants\naws s3api list-buckets --query 'Buckets[*].Name' --output text | while read bucket; do\n  policy=$(aws s3api get-bucket-policy --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  if echo \"$policy\" | grep -q '\"Principal\":\"*\"' 2>\u002Fdev\u002Fnull; then\n    echo \"PUBLIC POLICY DETECTED: $bucket\"\n  fi\ndone\n\n# Use AWS Config to find non-compliant buckets\naws configservice get-compliance-details-by-config-rule \\\n  --config-rule-name s3-bucket-public-read-prohibited \\\n  --compliance-types NON_COMPLIANT \\\n  --query 'EvaluationResults[*].EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId'\n```\n\n### Step 2: Enable S3 Block Public Access at Account Level\n\nApply the four Block Public Access settings at the AWS account level as a safety net. This prevents any bucket in the account from being made public, regardless of individual bucket policies or ACLs.\n\n```bash\n# Enable account-level Block Public Access (all four settings)\naws s3control put-public-access-block \\\n  --account-id 123456789012 \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n\n# Verify account-level settings\naws s3control get-public-access-block --account-id 123456789012\n\n# Enable at bucket level for defense in depth\naws s3api put-public-access-block \\\n  --bucket production-data-bucket \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n```\n\n### Step 3: Audit and Remediate Bucket Policies and ACLs\n\nReview all bucket policies for overly permissive Principal statements and remove legacy ACLs. Enforce bucket ownership controls to disable ACLs entirely.\n\n```bash\n# Remove a public bucket policy\naws s3api delete-bucket-policy --bucket exposed-bucket\n\n# Replace with a restrictive policy\naws s3api put-bucket-policy --bucket exposed-bucket --policy '{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"DenyUnencryptedTransport\",\n      \"Effect\": \"Deny\",\n      \"Principal\": \"*\",\n      \"Action\": \"s3:*\",\n      \"Resource\": [\n        \"arn:aws:s3:::exposed-bucket\",\n        \"arn:aws:s3:::exposed-bucket\u002F*\"\n      ],\n      \"Condition\": {\n        \"Bool\": {\"aws:SecureTransport\": \"false\"}\n      }\n    },\n    {\n      \"Sid\": \"AllowOnlyVPCEndpoint\",\n      \"Effect\": \"Deny\",\n      \"Principal\": \"*\",\n      \"Action\": \"s3:*\",\n      \"Resource\": [\n        \"arn:aws:s3:::exposed-bucket\",\n        \"arn:aws:s3:::exposed-bucket\u002F*\"\n      ],\n      \"Condition\": {\n        \"StringNotEquals\": {\"aws:SourceVpce\": \"vpce-0abc123def456\"}\n      }\n    }\n  ]\n}'\n\n# Enforce bucket owner for all objects (disable ACLs)\naws s3api put-bucket-ownership-controls --bucket exposed-bucket \\\n  --ownership-controls '{\"Rules\": [{\"ObjectOwnership\": \"BucketOwnerEnforced\"}]}'\n```\n\n### Step 4: Enforce Default Encryption\n\nEnable default server-side encryption with AWS KMS or AES-256 for all buckets. Add a bucket policy denying unencrypted object uploads.\n\n```bash\n# Enable default KMS encryption\naws s3api put-bucket-encryption --bucket production-data-bucket \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\n      \"ApplyServerSideEncryptionByDefault\": {\n        \"SSEAlgorithm\": \"aws:kms\",\n        \"KMSMasterKeyID\": \"arn:aws:kms:us-east-1:123456789012:key\u002Fkey-id\"\n      },\n      \"BucketKeyEnabled\": true\n    }]\n  }'\n\n# Deny unencrypted uploads via bucket policy\naws s3api put-bucket-policy --bucket production-data-bucket --policy '{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Sid\": \"DenyUnencryptedUploads\",\n    \"Effect\": \"Deny\",\n    \"Principal\": \"*\",\n    \"Action\": \"s3:PutObject\",\n    \"Resource\": \"arn:aws:s3:::production-data-bucket\u002F*\",\n    \"Condition\": {\n      \"StringNotEquals\": {\"s3:x-amz-server-side-encryption\": [\"aws:kms\", \"AES256\"]}\n    }\n  }]\n}'\n```\n\n### Step 5: Enable Access Logging and Monitoring\n\nConfigure S3 server access logging and CloudTrail data events to track all object-level operations. Set up EventBridge rules to alert on suspicious access patterns.\n\n```bash\n# Enable server access logging\naws s3api put-bucket-logging --bucket production-data-bucket \\\n  --bucket-logging-status '{\n    \"LoggingEnabled\": {\n      \"TargetBucket\": \"s3-access-logs-bucket\",\n      \"TargetPrefix\": \"production-data-bucket\u002F\"\n    }\n  }'\n\n# Enable CloudTrail S3 data events\naws cloudtrail put-event-selectors --trail-name management-trail \\\n  --event-selectors '[{\n    \"ReadWriteType\": \"All\",\n    \"DataResources\": [{\n      \"Type\": \"AWS::S3::Object\",\n      \"Values\": [\"arn:aws:s3:::production-data-bucket\u002F\"]\n    }]\n  }]'\n```\n\n### Step 6: Deploy Preventive Controls with SCP and Config\n\nUse Service Control Policies to prevent disabling Block Public Access across the organization. Deploy AWS Config rules with auto-remediation.\n\n```bash\n# SCP preventing Block Public Access removal\naws organizations create-policy \\\n  --name PreventS3PublicAccess \\\n  --type SERVICE_CONTROL_POLICY \\\n  --content '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Sid\": \"DenyRemovePublicAccessBlock\",\n      \"Effect\": \"Deny\",\n      \"Action\": [\n        \"s3:PutBucketPublicAccessBlock\",\n        \"s3:PutAccountPublicAccessBlock\"\n      ],\n      \"Resource\": \"*\",\n      \"Condition\": {\n        \"StringNotLike\": {\"aws:PrincipalArn\": \"arn:aws:iam::*:role\u002FSecurityAdmin\"}\n      }\n    }]\n  }'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| S3 Block Public Access | Four account-level and bucket-level settings that override any policy or ACL granting public access to S3 resources |\n| Bucket Policy | JSON-based resource policy attached to an S3 bucket defining who can access what objects under which conditions |\n| ACL (Access Control List) | Legacy S3 access mechanism that grants permissions at the bucket or object level; should be disabled via BucketOwnerEnforced |\n| BucketOwnerEnforced | Ownership control setting that disables all ACLs on a bucket, making the bucket owner the sole authority for access control |\n| Server-Side Encryption | Automatic encryption of objects at rest using AES-256 (SSE-S3), AWS KMS (SSE-KMS), or customer-provided keys (SSE-C) |\n| VPC Endpoint | Private connection between a VPC and S3 that restricts bucket access to traffic originating from within the VPC |\n| S3 Access Analyzer | IAM Access Analyzer capability that identifies S3 buckets shared with external entities outside the account or organization |\n\n## Tools & Systems\n\n- **AWS Config**: Evaluates S3 bucket compliance against managed rules and triggers auto-remediation for non-compliant resources\n- **Amazon Macie**: Discovers and classifies sensitive data in S3 buckets to identify which misconfigurations pose the highest data exposure risk\n- **IAM Access Analyzer**: Identifies S3 buckets with policies or ACLs that grant access to external principals\n- **S3 Storage Lens**: Provides organization-wide visibility into S3 usage patterns, access metrics, and security anomalies\n- **Prowler**: Open-source tool that checks S3 security configurations against CIS benchmarks and best practices\n\n## Common Scenarios\n\n### Scenario: Data Breach from Publicly Readable S3 Bucket Containing PII\n\n**Context**: A security researcher reports that an S3 bucket containing 273,000 bank transfer PDFs is publicly readable. The bucket was created by a developer who needed to share files with an external partner and set the ACL to public-read.\n\n**Approach**:\n1. Immediately enable Block Public Access on the specific bucket to stop the exposure\n2. Revoke all public ACLs by setting BucketOwnerEnforced ownership controls\n3. Audit CloudTrail and S3 access logs to determine which IP addresses accessed the exposed objects\n4. Run Macie on the bucket to classify the types of PII exposed and assess regulatory notification requirements\n5. Enable account-level Block Public Access to prevent recurrence across all buckets\n6. Deploy an SCP preventing any principal except SecurityAdmin from modifying Block Public Access settings\n7. Create a pre-signed URL mechanism or S3 Access Point for the legitimate partner sharing use case\n\n**Pitfalls**: Enabling Block Public Access without notifying the team that set up the public access breaks their workflow. Not running access log analysis before remediation loses evidence of who accessed the exposed data.\n\n## Output Format\n\n```\nS3 Bucket Security Remediation Report\n=======================================\nAccount: 123456789012\nAssessment Date: 2025-02-23\nBuckets Scanned: 156\n\nACCOUNT-LEVEL CONTROLS:\n  Block Public Access: ENABLED (all four settings)\n  SCP Preventing Removal: DEPLOYED\n\nCRITICAL FINDINGS (Remediated):\n  [S3-001] production-uploads - Public READ via ACL\n    Status: REMEDIATED - BucketOwnerEnforced applied\n    Objects Exposed: 273,412\n    Duration of Exposure: 47 days\n    Unique External IPs Accessed: 1,247\n\n  [S3-002] analytics-export - Public bucket policy (Principal: *)\n    Status: REMEDIATED - Policy replaced with VPC endpoint restriction\n    Sensitive Data (Macie): 12,400 objects with PII detected\n\nHIGH FINDINGS:\n  [S3-003] 14 buckets missing default encryption\n    Status: REMEDIATED - KMS encryption enabled\n  [S3-004] 8 buckets without server access logging\n    Status: REMEDIATED - Logging enabled to centralized log bucket\n\nSUMMARY:\n  Buckets Remediated: 24\u002F156\n  Encryption Coverage: 100%\n  Access Logging Coverage: 100%\n  Block Public Access: 156\u002F156 buckets\n```\n",{"name":5,"tags":54,"author":56,"domain":48,"license":15,"version":57,"nist_csf":58,"subdomain":43,"description":63,"mitre_attack":64},[36,35,55,34,33],"data-exposure","mahipal","1.0.0",[59,60,61,62],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Provides step-by-step procedures for remediating Amazon S3 bucket misconfigurations that expose sensitive data: enabling S3 Block Public Access, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and deploying automated remediation with AWS Config and Lambda. Use when AWS Config or Security Hub flags public or unencrypted S3 buckets, or preparing audit evidence for storage security controls.\n",[65,66,67,68,69],"T1078.004","T1530","T1537","T1580","T1573","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fremediating-s3-bucket-misconfiguration",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill remediating-s3-bucket-misconfiguration",{"tool":86,"command":87},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill remediating-s3-bucket-misconfiguration",{"tool":89,"command":90},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill remediating-s3-bucket-misconfiguration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fremediating-s3-bucket-misconfiguration\u002FSKILL.md",true,[94,100,104,109,113,117,123,127],{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"docs.md","REFERENCE","参考文档",9648,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fsuperpowers\u002Fskills\u002Fusing-code-directives\u002Fdocs.md",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"implement.md",7373,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fsuperpowers\u002Fskills\u002Fusing-code-directives\u002Fimplement.md",{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fremediating-s3-bucket-misconfiguration\u002FLICENSE",{"path":110,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":111,"sourceHtmlUrl":112},"refactor.md",8424,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fsuperpowers\u002Fskills\u002Fusing-code-directives\u002Frefactor.md",{"path":114,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fapi-reference.md",2595,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fremediating-s3-bucket-misconfiguration\u002Freferences\u002Fapi-reference.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",7661,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fremediating-s3-bucket-misconfiguration\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":125,"sourceHtmlUrl":126},"test.md",8708,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fsuperpowers\u002Fskills\u002Fusing-code-directives\u002Ftest.md",{"path":128,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":129,"sourceHtmlUrl":130},"todo.md",8362,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fsuperpowers\u002Fskills\u002Fusing-code-directives\u002Ftodo.md",[132,158,182,209,234,260],{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[138],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,141,142,143,40,48,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,154,167,168,40,169,48,146,170,171,172,173,174,175,176,177,178,179,180,181],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":192,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[188,191],{"categoryNo":189,"categoryName":190,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[176,193,194,195,196,48,197,198,170,199,200,201,202,203,204,37,205,206,207,208],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[215],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,48,220,221,222,223,224,225,226,42,227,228,229,230,173,231,232,233],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[240],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[242,243,244,48,245,246,247,248,249,250,251,252,253,32,254,255,256,257,258,259],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[266],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[40,268,48,269,270,271,272,273,274,275,276,37,277,205,278,279,280,281,282,283],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]