M ManySignal

Use Case: Cloud

S3 bucket exposure

A developer changed the bucket ACL to public-read to share a file with a vendor. The bucket also contains 4 years of customer records. ManySignal fires in 90 seconds.

Book a demo Cloud attack surface
Attack scenario

The misconfiguration that costs $4M

The Capital One breach (2019), Twitch source code leak (2021), and dozens of smaller incidents share a common root cause: an S3 bucket made accessible to the wrong audience. The misconfiguration is almost always accidental — a developer enabling public access to share a single file, a Terraform change that didn't include the Block Public Access parameter, or a legacy configuration copied from a Stack Overflow answer written in 2016 when S3 defaults were different.

The critical detection challenge is time. Internet crawlers — both security researchers and malicious actors — scan for newly-public S3 buckets within minutes. If you don't detect and remediate in under 10 minutes, assume the bucket has been indexed and plan for a potential data exposure.

Detection logic 
rule: s3_public_exposure
type: cloud_posture_event
sources:
  - aws_cloudtrail
  - aws_config_change
trigger:
  - event: [PutBucketAcl, PutBucketPolicy]
  - condition: |
      acl IN ["public-read", "public-read-write", "authenticated-read"]
      OR policy.Statement[].Principal == "*"
enrichments:
  - data_classification: amazon_macie, custom_dlp_tags
  - s3_access_logs: unauthenticated_get_requests_24h
  - public_index_check: grayhatwarfare, manysignal_crawl_feed
  - iac_attribution: terraform_cloud, github_actions
  - data_volume: s3_inventory
mitre: T1530 (Data from Cloud Storage)
Triage agent questions
1

What is the bucket's ACL setting — public-read, public-read-write, or authenticated-read?

S3 GetBucketAcl
2

Does the bucket policy allow s3:GetObject for Principal: '*'?

S3 GetBucketPolicy
3

What data classifications exist in the bucket (PII, PCI, PHI, source code)?

Macie / DLP scan
4

Who made the ACL or policy change, and from which IP and IAM session?

CloudTrail
5

Has the bucket been indexed by any known public internet crawlers in the past 24 hours?

Bucket vulnerability DB
6

Was this change part of a Terraform apply or a manual console/CLI operation?

IaC pipeline logs
7

How many objects are in the bucket, and what is the estimated data volume?

S3 inventory
Response playbook
1

Remove public ACL and set bucket to private via AWS API

Approve-gated
2

Enable S3 Block Public Access at the bucket and account level

Approve-gated
3

Run Amazon Macie scan on bucket contents to determine data sensitivity

Autonomous
4

Check S3 access logs for any unauthenticated GET requests in the past 72 hours

Autonomous
5

Notify data owner and legal/privacy team if PII or regulated data confirmed

Autonomous
6

If data was accessed: initiate breach notification assessment workflow

Recommend

Legacy SOC comparison

CSPM tools scan for misconfigured buckets on schedules — typically every 4 to 24 hours. A bucket made public at 10:00 AM may not appear in a CSPM finding until 6:00 AM the next day. Without real-time CloudTrail monitoring and Macie classification, the security team doesn't know whether the exposed bucket contained log files or customer financial records until they manually investigate the S3 contents.

MITRE ATT&CK mapping

T1530 — Data from Cloud StorageT1619 — Cloud Storage Object DiscoveryT1537 — Transfer Data to Cloud Account

S3 bucket exposure FAQ

Does ManySignal detect S3 exposure before or after the bucket is made public?

Both. ManySignal monitors CloudTrail in real time — the alert fires at the moment the ACL or bucket policy changes to allow public access, not when a crawler discovers it. This gives you minutes to remediate before any external access occurs.

What about Terraform-managed S3 configurations?

ManySignal integrates with Terraform Cloud, Atlantis, and GitHub Actions Terraform runs. When a public-access configuration is applied via IaC, the alert includes the pull request URL and author so the engineering team can revert through the same pipeline.

Does this cover GCS and Azure Blob in addition to S3?

Yes. Google Cloud Storage public access changes fire the same workflow via GCP Admin Activity logs. Azure Blob public access changes are detected via Azure Monitor. The data classification step uses the respective cloud provider's DLP service (Cloud DLP for GCS, Azure Purview for Blob).

How does ManySignal determine if the bucket was already crawled by internet scanners?

ManySignal cross-references open S3 bucket databases maintained by GrayhatWarfare, Buckhacker, and our own crawl-detection feed. If the bucket name appears in any of these indexes within the detection window, the alert is automatically escalated to a potential exposure incident.

Can ManySignal prevent accidental public exposure proactively?

Via AWS Config rules and SCP guardrails, ManySignal can configure preventive controls that block public ACL changes at the organization level. Reactive detection and preventive control work in tandem.

Detect public S3 changes before crawlers do

Real-time CloudTrail monitoring with Macie integration. From misconfiguration to remediation in under 5 minutes.

Book a demo Explore the platform