Lab 02 — Amazon S3 Misconfiguration Assessment

Lab Information

Item	Value
Module	02 — AWS Cloud Penetration Testing
Lab	02 — Amazon S3 Misconfiguration Assessment
Difficulty	Intermediate
Estimated Time	90 Minutes
Lab Type	AWS Offensive Security
Tools	AWS CLI, Amazon S3, IAM, IAM Access Analyzer, Amazon Macie (Optional)
Prerequisites	AWS Account, AWS CLI Configured, Read-Only Access to Amazon S3
Assessment Type	Enterprise Storage Security Assessment

Mission Brief

You are a Cloud Penetration Tester at CloudNova Technologies.

Your client, FinSecure Bank Ltd, wants to validate that sensitive information stored in Amazon S3 is protected against unauthorized access.

Your mission is to enumerate Amazon S3 buckets, review permissions, identify public exposure, evaluate encryption and discover misconfigurations that could lead to data leakage.

Learning Objectives

After completing this lab, you will be able to:

Enumerate Amazon S3 buckets.
Review bucket policies.
Identify public buckets.
Assess encryption and versioning.
Review bucket logging.
Analyze cross-account access.
Produce an enterprise S3 security assessment.

Enterprise Environment

The AWS environment contains:

Customer Data Buckets
Application Asset Buckets
CloudTrail Log Buckets
Static Website Buckets
Backup Buckets
Cross-Account Shared Buckets

Your objective is to determine whether any bucket exposes sensitive information.

Lab Architecture

AWS Account

↓

Amazon S3

├── Customer Records
├── Backups
├── Application Assets
├── CloudTrail Logs
├── Static Website
└── Shared Storage

Success Criteria

You successfully complete this lab when you can:

Enumerate all S3 buckets.
Review bucket policies.
Identify public buckets.
Validate encryption.
Verify versioning.
Assess logging.
Produce a professional storage security assessment.

Task 1 — Verify AWS Access

Confirm your AWS identity.

aws sts get-caller-identity

Questions

Which AWS account are you assessing?
Which IAM identity are you using?

Task 2 — Enumerate Amazon S3 Buckets

List all buckets.

aws s3 ls

Document:

Bucket Name
Region
Purpose
Owner

Questions

How many buckets exist?
Which buckets contain sensitive business data?
Which buckets appear unused?

Task 3 — Review Bucket Policies

Retrieve the bucket policy.

aws s3api get-bucket-policy \
--bucket BUCKET_NAME

Review:

Wildcard principals (*)
Cross-account access
Public read permissions
Public write permissions

Questions

Which buckets allow anonymous access?
Are any permissions overly broad?

Task 4 — Review Public Access Block

Check Block Public Access settings.

aws s3api get-public-access-block \
--bucket BUCKET_NAME

Verify:

Block Public ACLs
Ignore Public ACLs
Block Public Policies
Restrict Public Buckets

Questions

Are all four settings enabled?
Which buckets require remediation?

Task 5 — Review Bucket ACLs

Retrieve ACL information.

aws s3api get-bucket-acl \
--bucket BUCKET_NAME

Review:

Public Read
Public Read/Write
Authenticated Users
Bucket Owner

Questions

Are ACLs still being used?
Should Bucket Owner Enforced be enabled?

Task 6 — Review Bucket Encryption

Retrieve encryption settings.

aws s3api get-bucket-encryption \
--bucket BUCKET_NAME

Verify:

SSE-S3
SSE-KMS
KMS Key
Default Encryption

Questions

Which buckets are not encrypted?
Which KMS keys are being used?

Task 7 — Review Versioning

Check versioning configuration.

aws s3api get-bucket-versioning \
--bucket BUCKET_NAME

Verify:

Enabled
Suspended
Disabled

Questions

Which critical buckets have versioning disabled?
How would this affect ransomware recovery?

Task 8 — Review Bucket Logging

Retrieve logging configuration.

aws s3api get-bucket-logging \
--bucket BUCKET_NAME

Review:

Target Bucket
Target Prefix
Logging Enabled

Questions

Are access logs collected?
Where are logs stored?

Task 9 — Review Static Website Hosting

Check website configuration.

aws s3api get-bucket-website \
--bucket BUCKET_NAME

Review:

Website Enabled
Public Assets
Index Document
Error Document

Questions

Are sensitive files exposed through the website?
Is public access intentional?

Task 10 — Review Cross-Account Access

Analyze bucket policies for external access.

Review:

External AWS Accounts
Trusted Principals
Conditions
Resource Restrictions

Questions

Which buckets are shared externally?
Are business justifications documented?

Task 11 — Review Sensitive Data Exposure

Identify buckets storing:

Customer Records
Financial Reports
Database Backups
Credentials
Log Files
Infrastructure Files
Terraform State Files

(Optional)

Use Amazon Macie to classify sensitive data.

Questions

Which buckets require additional protection?
Are sensitive files encrypted?

Task 12 — Review IAM Access

Determine who can access each bucket.

Review:

IAM Users
IAM Roles
Resource Policies
Bucket Policies

Questions

Which identities have full control?
Which identities require reduced permissions?

Task 13 — Build an S3 Attack Path

Create an attack path similar to:

Public Bucket

↓

Database Backup

↓

Application Credentials

↓

IAM Access

↓

Production AWS Resources

Identify the business impact.

Task 14 — Risk Assessment

Classify findings.

Finding	Severity
Public Bucket	Critical
Public Write Access	Critical
No Encryption	High
Versioning Disabled	High
Missing Logging	Medium
Weak Bucket Policy	High
Cross-Account Access	Medium

Task 15 — Executive Recommendations

Recommend improvements such as:

Enable Block Public Access.
Encrypt all buckets.
Enable Versioning.
Enable Server Access Logging.
Remove unused buckets.
Implement least privilege.
Enable Amazon Macie.
Review bucket policies quarterly.

Bonus Challenge

Use IAM Access Analyzer to identify publicly accessible S3 resources.

Review Amazon Macie findings and classify sensitive data stored in buckets.

Document all publicly exposed objects and propose remediation steps.

Deliverables

Prepare an assessment containing:

Bucket Inventory
Public Access Review
Bucket Policy Assessment
Encryption Review
Versioning Assessment
Logging Review
Sensitive Data Assessment
Attack Path Analysis
Executive Summary
Remediation Plan

Expected Outcome

After completing this lab, you will have:

Enumerated enterprise Amazon S3 resources.
Identified public storage exposure.
Validated encryption and versioning.
Reviewed access controls and logging.
Identified storage attack paths.
Produced a professional enterprise Amazon S3 security assessment.

Key Takeaways

Amazon S3 is one of the most frequently targeted AWS services because it often stores critical business data.
Public access, weak bucket policies and missing encryption are common causes of cloud data breaches.
Encryption, versioning, logging and least-privilege access are essential controls for protecting enterprise storage.
Regular security assessments help identify storage risks before they become security incidents.
Enterprise cloud security teams should continuously monitor Amazon S3 for configuration drift and unauthorized access.

Next Lab

➡️ Lab 03 — Amazon EC2 Exploitation