Question

A company must ensure that no S3 bucket in its production account ever allows public read access. The security team wants an automated, event-driven mechanism that detects when a bucket becomes publicly readable and immediately reverts it to a private (blocked) state without any human intervention. The solution should also produce an audit trail of both the violation and the remediation action. Which approach best meets these requirements with the least custom code?

Accepted Answer

Create an AWS Config managed rule (s3-bucket-public-read-prohibited) and attach an automatic remediation action that invokes the AWS-DisableS3BucketPublicReadWrite Systems Manager Automation document; AWS Config records both the noncompliance and the remediation execution.

Answer

Enable S3 server access logging on every bucket and run a scheduled Lambda function every 5 minutes that parses the logs, detects public access, and calls PutPublicAccessBlock to remediate.

Answer

Create a CloudWatch alarm on the S3 BucketSizeBytes metric that triggers an SNS notification to the security team, who then manually apply a bucket policy to block public access.

Answer

Use an EventBridge scheduled rule that runs nightly to invoke a Lambda function which lists all buckets, checks their ACLs, and rewrites any public ones to private.