How to Detect and Remediate S3 and Azure Blob Storage Misconfigurations

Check organization-level Block Public Access (start here):

# Check if Block Public Access is enabled at the account level:
aws s3control get-public-access-block --account-id 123456789012

# Expected output (all four settings should be true):
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": true,
        "BlockPublicPolicy": true,
        "RestrictPublicBuckets": true
    }
}

# If any setting is false, enable Block Public Access at the account level:
aws s3control put-public-access-block \
  --account-id 123456789012 \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Audit all buckets in an account:

# List all buckets with their public access configuration:
for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
    echo -n "$bucket: "
    public=$(aws s3api get-bucket-policy-status --bucket "$bucket" \
        --query 'PolicyStatus.IsPublic' --output text 2>/dev/null)
    acl=$(aws s3api get-bucket-acl --bucket "$bucket" \
        --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`].Permission' \
        --output text 2>/dev/null)
    echo "Public policy: ${public:-NONE}, Public ACL: ${acl:-NONE}"
done

# Specifically find buckets with public-read or public-read-write ACL:
aws s3api list-buckets --query 'Buckets[].Name' --output text | \
  tr '\t' '\n' | \
  xargs -I {} bash -c '
    acl=$(aws s3api get-bucket-acl --bucket {} 2>/dev/null | 
      grep -c "AllUsers")
    [ "$acl" -gt 0 ] && echo "PUBLIC: {}"
  '

Enable S3 Access Analyzer (free, built-in):

# Enable in each region you use:
aws accessanalyzer create-analyzer \
  --analyzer-name S3PublicAccessAnalyzer \
  --type ACCOUNT \
  --region us-east-1

# List current findings (any public bucket access):
aws accessanalyzer list-findings \
  --analyzer-arn arn:aws:access-analyzer:us-east-1:123456789012:analyzer/S3PublicAccessAnalyzer \
  --filter '{"resourceType": {"eq": ["AWS::S3::Bucket"]}, "status": {"eq": ["ACTIVE"]}}'

# Install Prowler (Python-based, open source):
pip install prowler

# Configure AWS credentials (uses your current AWS CLI credentials):
aws configure  # Or use environment variables / IAM role

# Run all S3 checks across your AWS account:
prowler aws --service s3

# Run against specific CIS Benchmark controls:
prowler aws --compliance cis_2.0_aws --service s3

# Run against specific check IDs:
prowler aws --check s3_bucket_public_access s3_bucket_default_encryption \
  s3_bucket_logging s3_bucket_versioning_enabled

# Output to JSON for SIEM ingestion:
prowler aws --service s3 --output-formats json \
  --output-directory /tmp/prowler-results/

# Run across an entire AWS Organization (requires cross-account role):
prowler aws --service s3 --scan-unused-services \
  --organizations-role arn:aws:iam::MANAGEMENT_ACCOUNT:role/ProwlerRole

Key Prowler S3 checks to monitor:

Check ID                              Description
s3_bucket_public_access              Bucket not blocking all public access
s3_bucket_public_access_policy       Bucket policy grants public access
s3_bucket_default_encryption         Bucket missing default encryption
s3_bucket_logging                    Bucket access logging disabled
s3_bucket_versioning_enabled         Versioning not enabled (ransomware risk)
s3_bucket_secure_transport_policy    HTTP access allowed (not HTTPS-only)
s3_account_level_public_access_block Account-level public access not blocked

Set up continuous monitoring with AWS Config:

// AWS Config managed rule to detect non-compliant S3 buckets:
// Rule: s3-bucket-public-read-prohibited
// Trigger: Configuration changes to S3 buckets
// Action: Notify via SNS or auto-remediate via Systems Manager Automation

// Enable via AWS CLI:
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
  },
  "Scope": {
    "ComplianceResourceTypes": ["AWS::S3::Bucket"]
  }
}'

Check and disable public blob access across subscriptions:

# List all storage accounts with public blob access enabled:
az storage account list --subscription "your-subscription-id" \
  --query "[?allowBlobPublicAccess==\`true\`].{Name:name,RG:resourceGroup,PublicAccess:allowBlobPublicAccess}" \
  --output table

# Disable public blob access on a specific storage account:
az storage account update \
  --name mystorageaccount \
  --resource-group myresourcegroup \
  --allow-blob-public-access false

# Check if specific containers are set to public:
az storage container list \
  --account-name mystorageaccount \
  --auth-mode login \
  --query "[].{Name:name,PublicAccess:properties.publicAccess}" \
  --output table
# PublicAccess: null = private, blob = blob-level read, container = full container read

# Audit all containers across all storage accounts in a resource group:
for account in $(az storage account list -g myresourcegroup --query '[].name' -o tsv); do
    echo "=== $account ==="
    az storage container list --account-name $account --auth-mode login \
      --query "[?properties.publicAccess!=null].{Container:name,Access:properties.publicAccess}" \
      --output table 2>/dev/null
done

Enforce with Azure Policy (organization-wide):

Azure Policy: 'Storage accounts should prevent shared key access'
Azure Policy: 'Storage accounts should restrict network access'
Azure Policy: 'Secure transfer to storage accounts should be enabled'
Azure Policy: 'Public network access should be disabled for Azure Storage'

# Enable via Azure CLI:
az policy assignment create \
  --name 'deny-storage-public-access' \
  --policy '/providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751' \
  --scope '/subscriptions/your-subscription-id' \
  --enforcement-mode Default  # Deny mode: blocks non-compliant resources

Enable Microsoft Defender for Storage:

# Enable Defender for Storage on a subscription:
az security pricing create \
  --name StorageAccounts \
  --tier Standard

# Defender for Storage detects:
# - Anomalous public access patterns (attackers scanning blobs)
# - Malware uploaded to blob storage
# - Access from Tor exit nodes
# - Unusual geographic access
# - Potential data exfiltration patterns

# View Defender alerts:
az security alert list --location global \
  --query "[?contains(name,'Storage')]"

AWS Organizations SCP to prevent public buckets:

// Service Control Policy: prevents any account in the org from
// disabling S3 Block Public Access:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyS3PublicAccess",
      "Effect": "Deny",
      "Action": [
        "s3:PutBucketPublicAccessBlock",
        "s3:PutAccountPublicAccessBlock"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "s3:PublicAccessBlockConfiguration/BlockPublicAcls": "false",
          "s3:PublicAccessBlockConfiguration/IgnorePublicAcls": "false",
          "s3:PublicAccessBlockConfiguration/BlockPublicPolicy": "false",
          "s3:PublicAccessBlockConfiguration/RestrictPublicBuckets": "false"
        }
      }
    }
  ]
}

Automated remediation Lambda for non-compliant buckets:

import boto3

def lambda_handler(event, context):
    """Triggered by Config rule non-compliance: auto-blocks public access."""
    s3 = boto3.client('s3')
    
    # Get non-compliant bucket from Config event
    config_item = event.get('invokingEvent', {})
    bucket_name = event.get('resourceId', '')
    
    if not bucket_name:
        return
    
    # Apply Block Public Access to non-compliant bucket:
    s3.put_public_access_block(
        Bucket=bucket_name,
        PublicAccessBlockConfiguration={
            'BlockPublicAcls': True,
            'IgnorePublicAcls': True,
            'BlockPublicPolicy': True,
            'RestrictPublicBuckets': True
        }
    )
    
    # Log the remediation:
    print(f'Remediated: Applied Block Public Access to {bucket_name}')
    
    # Alert security team:
    sns = boto3.client('sns')
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts',
        Subject=f'Auto-remediated: Public S3 bucket {bucket_name}',
        Message=f'S3 bucket {bucket_name} had public access enabled.'
                f' Block Public Access has been automatically applied.'
    )