Public S3 bucket through bucket policy







EXPLOITABILITY Exploitability of a vulnerability measures how easy it is for an attacker to discover and exploit the vulnerability, some might refer to this as likelihood.

IMPACT How impactful to your environment and organization a successful exploitation of this vulnerability is expected to be.




S3 buckets can have bucket policies attached to them. Bucket policies that are configured incorrectly may allow public access to the data and configuration of the bucket.

Understanding Impact

Business Impact

S3 buckets are used for data storage. Publicly exposed buckets frequently lead to data leaks or ransomware.

Technical Impact

When a bucket policy allows IAM actions from any principal, it effectively makes it public, giving an attacker read/write access to the bucket contents.

Identify affected resources

Use the following command to retrieve a bucket's policy:

aws s3api get-bucket-policy --bucket your-bucket

If the bucket has no policy defined (NoSuchBucketPolicy), it is not vulnerable.

If the bucket policy grants actions to unauthenticated principals, the bucket is vulnerable.

Here is a sample vulnerable bucket policy that allows anyone to read objects inside it:

    "Version": "2012-10-17",
    "Statement": [
            "Sid": "PublicRead",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
            "Resource": [

You can also check if the bucket is publicly accessible by attempting to access it in an unauthenticated fashion.

aws s3 --no-sign-request ls bucket
aws s3 --no-sign-request cp s3://bucket/test.txt /tmp/test.txt
aws s3 --no-sign-request cp /tmp/test.txt s3://bucket/test.txt

Remediate vulnerable resources

Remove or modify the bucket policy so it does not allow public access.

You can also enable an account-wide public access block. This ensures that no S3 bucket in the AWS account is public.

How Datadog can help

Cloud Security Management

Datadog Cloud Security Management detects this vulnerability using the out-of-the-box rule "Datadog CSM Misconfigurations Rule | S3 bucket contents should only be accessible by authorized principals".


Using bucket policies

aws documentation

Leaky buckets in 2022

aws documentation

Blocking public access to your S3 storage

aws documentation

Did you find this article helpful?

Related Vulnerabilities and Threats