AWS S3 Bucket Hardening

About this program

Quick check of public-access, encryption, logging and lifecycle on your S3 estate. Built around the CIS AWS benchmark for S3.

Risks addressed

Critical Publicly readable bucket exposes sensitive data
High Unencrypted data at rest
High Accidental object deletion with no versioning
High Excessive cross-account access

Controls (7)

Block Public Access enabled account-wide
Critical

This control enforces Amazon S3 Block Public Access (BPA) settings at the AWS account level, preventing all buckets within the account from being configured with public access permissions. When enabled account-wide, BPA settings override individual bucket policies and access control…

How to test + evidence

Testing procedure: Run aws s3control get-public-access-block — all 4 settings true.

Evidence to collect: CLI output.
Default encryption set on all buckets
High

This control ensures that all cloud storage buckets (e.g., AWS S3, Azure Blob Storage, GCP Cloud Storage) are configured with default encryption enabled, either using server-side encryption with platform-managed keys (SSE-S3, SSE-AES256) or customer-managed keys (SSE-KMS, CMK). Default encryption applies…

How to test + evidence

Testing procedure: Run s3api get-bucket-encryption per bucket; SSE-S3 or SSE-KMS expected.

Evidence to collect: CLI output / Config rule.
Versioning enabled for buckets holding important data
Medium

This control requires that object versioning be enabled on cloud storage buckets (e.g., AWS S3, Azure Blob Storage, Google Cloud Storage) containing data classified as important, sensitive, or business-critical. Versioning preserves previous versions of objects when they are overwritten or…

How to test + evidence

Testing procedure: For Tier-1 buckets, verify Versioning=Enabled.

Evidence to collect: CLI output.
Server access logging enabled
Medium

Server access logging enabled ensures that all authentication attempts, session establishment, privileged commands, and file access events are recorded on servers (physical, virtual, or cloud-based) with sufficient detail to support forensic analysis and anomaly detection. This control requires logging to…

How to test + evidence

Testing procedure: Confirm access logs are written to a centralised logging bucket.

Evidence to collect: CLI output + log destination.
MFA Delete enabled for critical buckets
High

MFA Delete is an Amazon S3 bucket versioning feature that requires multi-factor authentication to permanently delete object versions or suspend versioning on a bucket. When enabled, deletion operations require both the requestor's AWS credentials and a valid MFA token from…

How to test + evidence

Testing procedure: Verify MFA Delete on production data buckets.

Evidence to collect: CLI output.
Lifecycle policies in place
Low

Lifecycle policies define the requirements and procedures for managing technology assets, software, and data throughout their entire existence—from acquisition and deployment through operation, maintenance, and eventual decommissioning or disposal. These policies establish mandatory stages, approval gates, security baseline requirements, and…

How to test + evidence

Testing procedure: Buckets have lifecycle rules to expire / transition old objects.

Evidence to collect: CLI output of get-bucket-lifecycle.
Cross-account access reviewed
High

Cross-account access reviewed is a control requiring periodic evaluation of all trust relationships, IAM roles, and federated access permissions that allow users or services from one cloud account (or tenant) to access resources in another. Organizations maintain inventories of cross-account…

How to test + evidence

Testing procedure: Review bucket policies for wildcards / cross-account principals. Confirm justification.

Evidence to collect: Bucket policies export.