AnalysisType: rule
Filename: aws_s3_delete_public_access_block.py
RuleID: "AWS.S3.DeletePublicAccessBlock"
DisplayName: "S3 Public Access Block Deleted"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Defense Evasion
- Initial Access
Reports:
MITRE ATT&CK:
- TA0005:T1562
- TA0001:T1190
Severity: Medium
Status: Experimental
Description: Detects when S3 bucket public access block configuration is deleted, which could allow unauthorized public access to sensitive data or indicate preparation for data exfiltration.
Runbook: |
1. Query CloudTrail for all S3 API calls by the userIdentity:arn on the requestParameters:bucketName in the 24 hours before and after the public access block deletion
2. Find any PutBucketPolicy or PutBucketAcl events on this bucket in the 1 hour after the deletion to check if the bucket or objects were made public
3. Search for GetObject events from public IP addresses on this bucket in the 6 hours after the deletion to detect unauthorized data access
Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
SummaryAttributes:
- sourceIpAddress
- userAgent
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: Public Access Block Deleted Successfully
ExpectedResult: true
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
"accountId": "111111111111",
"accessKeyId": "ASIA-MOCKACCESSKEYID-1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "false",
"creationDate": "2024-01-15T10:30:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "AAAAAAAAAAAAAAAAAAAAA",
"arn": "arn:aws:iam::111111111111:role/sample-role-dreamy-yonath",
"accountId": "111111111111",
"userName": "AdminRole",
},
},
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "DeleteBucketPublicAccessBlock",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters":
{
"bucketName": "corporate-documents",
"host": "sample-bucket-sweet-kepler.s3.amazonaws.com",
"publicAccessBlock": "",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
"vpcEndpointId": "vpce-1a2b3c4d",
}
- Name: Public Access Block Deletion Failed
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "IAMUser",
"principalId": "AIDAI23HXS4EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/testuser",
"accountId": "111111111111",
"accessKeyId": "AKIA-MOCKACCESSKEYID-1",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "DeleteBucketPublicAccessBlock",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"errorCode": "AccessDenied",
"errorMessage": "Access Denied",
"requestParameters":
{
"bucketName": "corporate-documents",
"host": "sample-bucket-sweet-kepler.s3.amazonaws.com",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
}
- Name: Different S3 Event
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
"accountId": "111111111111",
"accessKeyId": "ASIA-MOCKACCESSKEYID-1",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "PutBucketPublicAccessBlock",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters":
{
"bucketName": "corporate-documents",
"host": "sample-bucket-sweet-kepler.s3.amazonaws.com",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
}
- Name: Non-S3 Event
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::123456789012:assumed-role/AdminRole/user_name",
"accountId": "123456789012",
"accessKeyId": "ASIAIOSFODNN7EXAMPLE",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "DeleteBucketPublicAccessBlock",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.42",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters": {},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-123456789012",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789012",
}
# ------ paired body: aws_s3_delete_public_access_block.py ------
from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
def rule(event):
return (
aws_cloudtrail_success(event)
and event.get("eventSource") == "s3.amazonaws.com"
and event.get("eventName") == "DeleteBucketPublicAccessBlock"
)
def title(event):
return (
f"[AWS.CloudTrail] User [{event.udm('actor_user')}] "
f"deleted public access block for bucket "
f"[{event.deep_get('requestParameters', 'bucketName')}] bucket"
)
def alert_context(event):
return aws_rule_context(event)