Lesson 06 — Amazon S3 Security Testing

Learning Objectives

By the end of this lesson, you will be able to:

Understand Amazon S3 architecture.
Identify common Amazon S3 attack surfaces.
Review bucket permissions and policies.
Assess encryption and versioning.
Understand object ownership and access control.
Identify common S3 attack paths.
Perform enterprise Amazon S3 security assessments.

Introduction

Amazon S3 (Simple Storage Service) is one of AWS’s most widely used storage services.

Organizations use S3 to store:

Customer records
Financial reports
Application assets
Website content
Backups
Container images
Logs
Terraform state files
Data lake files

Because Amazon S3 often contains business-critical information, it is one of the first services assessed during AWS penetration testing engagements.

Most Amazon S3 breaches occur due to misconfigurations, not AWS platform vulnerabilities.

Enterprise Scenario

CloudNova Technologies has been hired to perform an AWS security assessment for FinSecure Bank Ltd.

The organization stores:

Customer Statements
KYC Documents
Database Backups
Application Logs
CloudTrail Logs
Static Website Assets

Management wants to determine whether sensitive data stored in Amazon S3 is adequately protected from unauthorized access.

Amazon S3 Architecture

Users

↓

Applications

↓

Amazon S3 Bucket

↓

Folders (Prefixes)

↓

Objects

↓

Sensitive Data

Access to buckets and objects is controlled through IAM, bucket policies and other access control mechanisms.

Amazon S3 Components

Amazon S3 includes:

Buckets
Objects
Bucket Policies
Access Control Lists (ACLs)
Versioning
Encryption
Object Ownership
Lifecycle Policies
Logging
Replication

Each component should be reviewed during a security assessment.

Amazon S3 Attack Surface

Cloud Penetration Testers typically assess:

Public Buckets
Bucket Policies
IAM Permissions
ACLs
Versioning
Encryption
Object Ownership
Static Website Hosting
Cross-Account Access
Replication Rules

Misconfigurations in any of these areas can expose sensitive data.

Common Amazon S3 Misconfigurations

Frequently observed issues include:

Publicly accessible buckets
Public object access
Missing encryption
Disabled versioning
Weak bucket policies
Cross-account access without restrictions
Disabled logging
Public static websites exposing sensitive files
Sensitive backups stored in public buckets

Bucket Policies

Bucket policies define who can access an S3 bucket and what actions they may perform.

Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect":"Allow",
      "Principal":"*",
      "Action":"s3:GetObject",
      "Resource":"arn:aws:s3:::example-bucket/*"
    }
  ]
}

This configuration allows anyone on the internet to read objects within the bucket.

Review policies for:

Wildcard principals (*)
Overly broad actions
Unrestricted resources
Missing conditions

Public Access Block

Amazon S3 provides Block Public Access settings to prevent accidental exposure.

Review:

Block public ACLs
Ignore public ACLs
Block public bucket policies
Restrict public bucket policies

Enterprise environments should enable all Block Public Access settings unless a documented business requirement exists.

Access Control Lists (ACLs)

ACLs provide legacy object-level permissions.

Examples:

Private
Public Read
Public Read/Write
Authenticated Users

AWS recommends using Bucket Policies and IAM instead of ACLs where possible.

Object Ownership

Object Ownership determines who owns uploaded objects.

Options include:

Bucket Owner Enforced
Bucket Owner Preferred
Object Writer

Best Practice:

Use Bucket Owner Enforced, which disables ACLs and simplifies access management.

Encryption

Amazon S3 supports:

SSE-S3
SSE-KMS
SSE-C
Client-side Encryption

Review:

Default encryption
KMS key policies
Key rotation
Access permissions

Sensitive data should always be encrypted.

Versioning

Versioning protects against:

Accidental deletion
Ransomware
Unauthorized modification

Review:

Enabled
Suspended
Lifecycle configuration

Versioning improves resilience and supports recovery.

Logging

Review:

Server Access Logging
CloudTrail Data Events
CloudWatch Integration

Logging supports:

Audit
Detection
Forensics
Compliance

Static Website Hosting

Amazon S3 can host static websites.

Review:

Public accessibility
Bucket policy
Index documents
Error pages
Sensitive content

Ensure that only intended public assets are exposed.

Cross-Account Access

Bucket policies may allow access from other AWS accounts.

Review:

Trusted accounts
External principals
Conditions
Least privilege

Improper cross-account access can expose sensitive data.

Amazon S3 Enumeration Commands

List buckets

aws s3 ls

Retrieve bucket policy

aws s3api get-bucket-policy \
--bucket BUCKET_NAME

Review public access settings

aws s3api get-public-access-block \
--bucket BUCKET_NAME

Review encryption

aws s3api get-bucket-encryption \
--bucket BUCKET_NAME

Review versioning

aws s3api get-bucket-versioning \
--bucket BUCKET_NAME

Review logging

aws s3api get-bucket-logging \
--bucket BUCKET_NAME

Review website configuration

aws s3api get-bucket-website \
--bucket BUCKET_NAME

Review ACL

aws s3api get-bucket-acl \
--bucket BUCKET_NAME

Enterprise Attack Path

Public Bucket

↓

Customer Database Backup

↓

Sensitive Customer Data

↓

Credential Discovery

↓

AWS IAM

↓

Additional Cloud Resources

A single exposed S3 bucket can provide attackers with information that enables further compromise.

Enterprise Assessment Workflow

Professional consultants generally follow this methodology.

Enumerate Buckets

↓

Review Bucket Policies

↓

Review Public Access

↓

Review ACLs

↓

Review Encryption

↓

Review Versioning

↓

Review Logging

↓

Review Cross-Account Access

↓

Identify Attack Paths

↓

Document Findings

Common Enterprise Findings

Examples include:

Public buckets
Public object access
Wildcard bucket policies
Disabled encryption
Disabled versioning
Missing logging
Weak IAM permissions
Shared buckets between business units
Public backup archives
Sensitive data in static website buckets

Security Best Practices

Enable Block Public Access.
Encrypt all buckets using SSE-KMS or SSE-S3.
Enable Versioning.
Disable ACLs by using Bucket Owner Enforced.
Apply least-privilege bucket policies.
Enable Server Access Logging and CloudTrail Data Events.
Review cross-account access regularly.
Use Amazon Macie to identify sensitive data.
Classify and tag data according to sensitivity.

Common Mistakes

Avoid:

Allowing Principal: "*".
Hosting confidential files in public buckets.
Disabling encryption.
Disabling versioning.
Ignoring bucket logging.
Leaving obsolete buckets unmanaged.
Sharing buckets across unrelated workloads.
Storing credentials or secrets in S3.

Knowledge Check

1. Why is Amazon S3 frequently targeted during AWS penetration tests?

Answer: Amazon S3 often stores sensitive business data such as backups, customer records and application assets. Misconfigured permissions can expose this information to unauthorized users.

2. What is the purpose of Block Public Access?

Answer: Block Public Access prevents accidental exposure of S3 buckets and objects by overriding or blocking public access settings.

3. Why is Bucket Owner Enforced recommended?

Answer: It disables Access Control Lists (ACLs), simplifies permission management and ensures the bucket owner has full ownership of all objects.

4. Why should Versioning be enabled?

Answer: Versioning protects against accidental deletion, unauthorized modification and ransomware by preserving previous versions of objects.

5. Why should CloudTrail Data Events be enabled for Amazon S3?

Answer: CloudTrail Data Events record object-level activity, improving visibility, supporting forensic investigations and helping detect unauthorized access.

Key Takeaways

Amazon S3 is one of the most frequently assessed AWS services because it often contains sensitive organizational data.
Most S3 security incidents result from misconfigurations rather than AWS platform vulnerabilities.
Reviewing bucket policies, public access settings, encryption and versioning is essential during an enterprise security assessment.
Strong governance, logging and least-privilege access significantly reduce the risk of data exposure.
A structured assessment of Amazon S3 helps identify attack paths that could lead to broader AWS compromise.

What’s Next?

In the next lesson, you will explore Lesson 07 — AWS Lambda & Serverless Security, where you will learn how attackers assess serverless workloads, review Lambda execution roles, environment variables, event sources and common serverless attack techniques used in enterprise AWS environments.

➡️ Next Lesson: Lesson 07 — AWS Lambda & Serverless Security