Anonymous S3 Requests - Evading AWS Logging Exposed

What Happened

Varonis Threat Labs (VTL) discovered a significant vulnerability in AWS that allows anonymous requests to S3 buckets to evade logging in CloudTrail Network Activity events. This means that even if a bucket's permissions deny anonymous access, there are no logs indicating any such requests. In some instances, there were no logs at all, posing a severe risk to organizations.

How the Attack Works

When an attacker uses anonymous access within a Virtual Private Cloud (VPC) to access data from a bucket, the requests can trigger logs in the account. However, if the attacker accesses an external bucket, no events are logged at all. This lack of visibility allows attackers to interact with public buckets without detection. The absence of logs means that security teams cannot trace back any suspicious activity, leaving organizations vulnerable to data breaches.

AWS’ Response

In response to this vulnerability, AWS collaborated with Varonis to update CloudTrail's logging behavior. Now, all anonymous API requests made to external S3 buckets via VPC endpoints are logged as CloudTrail network activity events. This update aims to enhance visibility and security for VPC endpoint owners, ensuring that unauthorized access attempts can be detected.

Mitigation Strategies for Evasive Attacks

To protect against these evasive attacks, organizations should consider the following strategies:

1. Restrict VPC Endpoint Policies: Apply the principle of least privilege to VPC endpoint policies, explicitly denying anonymous access.
2. Audit Bucket Policies Regularly: Identify and remediate overly permissive bucket policies to minimize exposure.
3. Enable Alerts on Policy Changes: Set up notifications for any changes to VPC endpoint or bucket policies to stay informed of potential risks.

Conclusion

The discovery of this vulnerability highlights the importance of robust logging practices in cloud environments. Without proper logging, organizations may remain unaware of unauthorized access, leading to potential data loss. By implementing the recommended strategies and utilizing AWS's updated logging features, organizations can better protect their data and maintain a secure cloud environment.