Question

A financial services company must ensure that any S3 bucket in its production account that becomes publicly accessible is automatically remediated within minutes, and the security team is notified. The security engineer wants a fully serverless, event-driven solution that reacts to configuration changes rather than relying on periodic scans. Which approach best meets these requirements?

Accepted Answer

Create an AWS Config managed rule (s3-bucket-public-read-prohibited) with an EventBridge rule that triggers on the NON_COMPLIANT evaluation, invoking a Lambda function that applies S3 Block Public Access and publishes to an SNS topic.

Answer

Schedule a CloudWatch Events rule every 5 minutes to run a Lambda function that lists all buckets and checks their ACLs and policies for public access, then remediates and emails the team.

Answer

Enable Amazon Macie to continuously classify bucket contents and configure a Macie finding to trigger a Systems Manager Automation runbook that removes the public policy.

Answer

Turn on S3 server access logging and use Amazon Athena queries executed hourly to detect anonymous access, then manually revoke the bucket policy when public reads are found.