Question

A company must ensure that no S3 bucket in any account ever has its account-level Block Public Access setting disabled without immediate reversal. When an engineer runs PutPublicAccessBlock to weaken the setting, a security team wants automated remediation within seconds and a durable record of who triggered the change. CloudTrail is enabled in all accounts and management events flow to a central account. Which approach BEST meets these requirements with the least ongoing operational effort?

Accepted Answer

Create an EventBridge rule that matches the CloudTrail management event for PutPublicAccessBlock, target an SSM Automation runbook that re-applies the fully-restricted Block Public Access configuration, and rely on the CloudTrail event record for attribution.

Answer

Enable AWS Config with the s3-account-level-public-access-blocks managed rule and configure periodic evaluation with an SSM automatic remediation to fix noncompliant accounts.

Answer

Schedule a Lambda function every 5 minutes using EventBridge Scheduler to call GetPublicAccessBlock in each account and re-apply the restricted configuration when drift is detected.

Answer

Create a CloudWatch metric filter on the central log group for PutPublicAccessBlock and an alarm that triggers an SNS notification to the security team to manually revert the change.