AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock
Alerts when CloudTrail shows S3 Block Public Access settings being weakened (set to false) in PutBucketPublicAccessBlock with Success.
- Product
- aws
- Service
- cloudtrail
- Author
- Shoban Chiddarth (SigmaHQ), DRL 1.1
- Published
- 2026-10-21
- Updated
- 2026-10-21
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful S3 PutBucketPublicAccessBlock actions where one or more Block Public Access controls are set to false (RestrictPublicBuckets, BlockPublicAcls, BlockPublicPolicy, or IgnorePublicAcls). Weakening these safeguards can enable public exposure if an attacker later changes ACLs or bucket policies. The detection relies on AWS CloudTrail eventName, errorCode, and requestParameters in the PutBucketPublicAccessBlock event.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_block_public_access_weakened.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock"
id: 00d403e0-69fa-4a76-a1f0-d53f4f3c63c1
status: experimental
description: This rule identifies successful S3 PutBucketPublicAccessBlock actions where one or more Block Public Access controls are set to false (RestrictPublicBuckets, BlockPublicAcls, BlockPublicPolicy, or IgnorePublicAcls). Weakening these safeguards can enable public exposure if an attacker later changes ACLs or bucket policies. The detection relies on AWS CloudTrail eventName, errorCode, and requestParameters in the PutBucketPublicAccessBlock event.
references:
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_block_public_access_weakened.yml
author: Shoban Chiddarth, Huntrule Team
date: 2026-10-21
tags:
- attack.defense-impairment
- attack.t1686.001
logsource:
product: aws
service: cloudtrail
detection:
selection_event_name:
eventSource: s3.amazonaws.com
eventName: PutBucketPublicAccessBlock
selection_weaken_restrict_public_buckets:
requestParameters.PublicAccessBlockConfiguration.RestrictPublicBuckets: "false"
selection_weaken_block_public_acls:
requestParameters.PublicAccessBlockConfiguration.BlockPublicAcls: "false"
selection_weaken_block_public_policy:
requestParameters.PublicAccessBlockConfiguration.BlockPublicPolicy: "false"
selection_weaken_ignore_public_acls:
requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls: "false"
selection_status_success:
errorCode: Success
selection_status_null:
errorCode: null
condition: selection_event_name and 1 of selection_weaken_* and 1 of selection_status_*
falsepositives:
- Administrators intentionally modifying Block Public Access settings to support a legitimate application or public bucket configuration.
level: medium
license: DRL-1.1
related:
- id: ab18a523-e093-4ac6-8303-8c47431f4fca
type: derived