# 4.8 Ensure S3 Bucket Policy Changes are Monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233138-4-8-ensure-s3-bucket-policy-changes-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 4](https://support.icompaas.com/support/solutions/folders/62000169196) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** ## **Description:** AWS CloudTrail enables real-time monitoring of API calls by logging events to CloudWatch Logs or an external SIEM. Monitoring S3 bucket policy changes ensures that S3 bucket configurations remain secure and compliant. Amazon S3 bucket policies define access permissions for buckets. Unauthorized or accidental changes to these policies can result in: - Unintended public exposure of sensitive data. - Unauthorized access to or modification of stored objects. - Compliance violations leading to security risks. This control ensures that S3 bucket policy modifications (e.g., ACL changes, policy updates, CORS, lifecycle rules, replication settings) are logged, monitored, and alerted using CloudWatch Alarms and Amazon SNS notifications. ## Rationale: Monitoring S3 bucket policy changes helps detect: - Unauthorized modifications that allow excessive access to S3 buckets. - Accidental misconfigurations that expose data to the public. - Security incidents involving unexpected changes to bucket permissions. ## Impact: - Failure to monitor S3 bucket policy changes can result in: - Exposure of sensitive data to unauthorized users. - Loss of control over object access and permissions. - Security misconfigurations leading to compliance violations. - Enabling monitoring does not impact performance, but it requires AWS CloudTrail and CloudWatch costs. ## Default Value: - AWS CloudTrail does not log S3 bucket policy changes by default. - CloudWatch Alarms and SNS notifications must be manually configured to monitor S3 bucket policy modifications. ## Pre-Requisites: 1. AWS CloudTrail enabled with multi-region logging. 2. AWS CloudWatch Logs enabled and linked to CloudTrail. 3. IAM Permissions Required: - cloudtrail:DescribeTrails - cloudtrail:GetEventSelectors - logs:DescribeMetricFilters - cloudwatch:DescribeAlarms - sns:ListSubscriptionsByTopic - logs:PutMetricFilter, cloudwatch:PutMetricAlarm, sns:CreateTopic ## Remediation: ### Test Plan: ## Using AWS Console 1. Login to the AWS Management Console. 2. Navigate to CloudTrail: [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/home). ![](https://support.icompaas.com/assets/kb/03667b8f3105cdbe.png) 3. Verify there is at least one multi-region CloudTrail trail enabled. 4. Ensure CloudTrail is logging management events: - Click on the trail and check Event Selectors. ![](https://support.icompaas.com/assets/kb/5e6723ed045a884c.png) - Ensure management events are set to "All". ![](https://support.icompaas.com/assets/kb/041d7641627fddab.png) 5. Check that CloudTrail logs are being sent to CloudWatch. 6. Navigate to CloudWatch Logs: [AWS CloudWatch Console](https://console.aws.amazon.com/cloudwatch/home). ![](https://support.icompaas.com/assets/kb/33d4c8c4d3eaad5d.png) 7. Ensure that a metric filter is created for S3 bucket policy changes. ![](https://support.icompaas.com/assets/kb/6e2e64169e08d91c.png) 8. Check CloudWatch Alarms for alerts on S3 bucket policy modifications. ![](https://support.icompaas.com/assets/kb/6ccadaa5add4ad2c.png) Implementation Steps: Using AWS CLI ### Step 1: Create a Metric Filter for S3 Bucket Policy Changes aws logs put-metric-filter --log-group-name \\ --filter-name s3-bucket-policy-changes-metric \\ --metric-transformations metricName=s3-bucket-policy-changes-metric,metricNamespace="CISBenchmark",metricValue=1 \\ --filter-pattern '{ ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }' Step 2: Create an SNS Topic for Notifications aws sns create-topic --name s3-bucket-policy-changes-alerts Step 3: Subscribe to SNS Topic aws sns subscribe --topic-arn --protocol email --notification-endpoint Step 4: Create a CloudWatch Alarm for S3 Bucket Policy Changes aws cloudwatch put-metric-alarm --alarm-name s3-bucket-policy-changes-alarm \\ --metric-name s3-bucket-policy-changes-metric --statistic Sum --period 300 \\ --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \\ --evaluation-periods 1 --namespace "CISBenchmark" --alarm-actions Backout Plan: 1. Delete CloudWatch Alarm: aws cloudwatch delete-alarms --alarm-names s3-bucket-policy-changes-alarm 2. Remove the metric filter: aws logs delete-metric-filter --log-group-name --filter-name s3-bucket-policy-changes-metric 3. Delete SNS topic: aws sns delete-topic --topic-arn ## References: - [AWS CloudTrail Monitoring with CloudWatch](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [Amazon S3 Bucket Policies](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

8.5

Collect detailed audit logs for security monitoring.

CIS v8

8.11

Conduct audit log reviews to detect anomalies.

CIS v7

6.3

Enable detailed logging for security monitoring.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.