Use Case: Cloud
Public cloud storage exposure
A GCS bucket containing 2 years of customer orders was made publicly accessible via an IAM policy change. ManySignal fired the alert in 75 seconds — before any crawler indexed the bucket.
The 10-minute window before your data is indexed
Cloud storage misconfiguration is one of the most common breach vectors in enterprise cloud environments. The pattern repeats: a developer grants public access to share a file with a partner, forgetting the bucket contains years of accumulated data beyond the one file they intended to share. Internet crawlers find newly-public buckets within minutes. Without real-time detection, the security team finds out from a researcher's disclosure or, worse, a news story.
The detection is straightforward when the audit logs are monitored in real time: any IAM policy change that adds allUsers or allAuthenticatedUsers to a GCS bucket is a P1 event. The difficulty is that most cloud security tools check for this on a schedule — hours after the exposure began.
rule: cloud_storage_public_exposure
type: cloud_posture_event + classification
sources:
- gcp_admin_activity (storage.setIamPolicy)
- azure_monitor (Microsoft.Storage/storageAccounts/blobServices)
- aws_cloudtrail (PutBucketPolicy, PutBucketAcl)
trigger:
- condition: |
iam_binding.member IN ["allUsers", "allAuthenticatedUsers"] # GCS
OR container.publicAccess != "None" # Azure
OR bucket.acl.grantee == "*" # S3
enrichments:
- data_classification: macie, cloud_dlp, purview, naming_convention
- public_index_check: grayhatwarfare, manysignal_crawler
- iac_attribution: terraform_resource, gcloud_deployment_manager
- object_count_volume: storage_inventory_api
mitre: T1530 (Data from Cloud Storage)MITRE ATT&CK mapping
Cloud storage exposure FAQ
Does this detection cover GCS buckets, Azure Blob, and S3 simultaneously?
Yes. ManySignal monitors GCP Admin Activity logs for GCS IAM policy changes, Azure Monitor for Blob container access policy changes, and AWS CloudTrail for S3 ACL changes — all normalized into the same cloud storage exposure event model. The triage and response workflow is identical regardless of provider.
How does ManySignal determine data sensitivity without scanning every object?
ManySignal uses three layers: existing DLP tags (Amazon Macie findings, GCP Cloud DLP tags, Azure Purview labels), bucket naming conventions (buckets named 'pii-data', 'customer-records', 'financial-backups'), and a sampling scan that checks 100-200 objects for known sensitive patterns. Combined, these provide a risk-weighted exposure severity assessment without requiring a full object scan.
What regulatory implications does public cloud storage exposure create?
GDPR Article 33 requires notification within 72 hours of discovering a personal data breach. HIPAA requires notification within 60 days. PCI DSS requires immediate investigation of any cardholder data exposure. ManySignal's legal notification workflow includes pre-populated breach assessment templates for each regulation, triggered automatically when regulated data is confirmed in an exposed storage container.
Can ManySignal prevent public access changes entirely?
Via AWS Service Control Policies, GCP Organization Policies, and Azure Policy definitions, ManySignal can recommend or deploy preventive controls that block public access changes at the organization level. These controls complement the detective capability.
Detect public cloud storage changes across AWS, GCP, and Azure
Real-time cloud audit monitoring with data classification — not a daily CSPM scan.