S3 Security Guardrails Stack
AWS Config rules plus Lambda auto-remediation that automatically blocks any S3 bucket that becomes public. Includes SNS alert on remediation.
S3 Security Guardrails Stack
Public S3 buckets remain one of the most common causes of cloud data breaches. This stack closes the gap between detection and remediation — automatically blocking public access the moment a bucket is misconfigured, then notifying your team.
How It Works
- AWS Config evaluates every S3 bucket for public access block settings and public bucket policies on a continuous basis.
- When a non-compliant bucket is detected, Config triggers an automatic SSM Automation remediation that calls
PutPublicAccessBlockto restore the safe configuration. - An SNS topic fires a formatted notification with the bucket name, the offending policy, who made the change (from CloudTrail), and the timestamp — delivered to email or Slack webhook.
Config Rules Included
s3-bucket-public-read-prohibiteds3-bucket-public-write-prohibiteds3-bucket-server-side-encryption-enableds3-bucket-logging-enableds3-bucket-versioning-enableds3-bucket-policy-grantee-check
What You Get
s3-guardrails.yaml— CloudFormation templateremediation/— Lambda and SSM Automation document sourceslack-webhook.md— wiring the SNS topic to Slack via a Lambda forwarderREADME.md— deployment and exclusion list for intentionally-public buckets
Requirements
AWS Config must be enabled (or deployed together with the AWS Account Security Bootstrap product). Remediation Lambda requires IAM permissions scoped to s3:PutBucketPublicAccessBlock.