Using Amazon S3, they can store objects and files on a virtual server instead of on physical racks in simple terms. The service is basically “A box for IT and Tech teams”.
After the user has created their bucket, they can start storing their source code, certificates, passwords, content, databases, and other data.
While AWS promises safely stored data and secure up-and downloads, the security community has pointed out severe misconfigurations for a long time.
If you are vulnerable, attackers could get full access to your S3 bucket, allowing them to download, upload, and overwrite files.

AWS Security Misconfiguration

What makes a misconfiguration critical? Many things! And it’s straightforward for hackers to exploit misconfigurations.
The Amazon S3 bucket name is not something secret, and there are few ways to check it out.
Once the attacker knows it, multiple misconfigurations can either access or modify information, leading to three different scenarios.
By using the AWS Command Line with Amazon API, he can:

• Get access to the list and read files in the S3 bucket.
• Write files to an S3 bucket.
• Upload files to an S3 bucket
• Change access rights to all objects.
• Control the content of the files and objects

The main vulnerability types

• Amazon S3 bucket allows for full anonymous access.
• Amazon S3 bucket allows for arbitrary file listing.
• Amazon S3 bucket allows for arbitrary file upload and exposure.
• Amazon S3 bucket allows for blind uploads.
• Amazon S3 bucket allows arbitrary read/writes of objects.
• Amazon S3 bucket reveals ACP/ACL.

Signs for a Critical AWS Security Misconfiguration

So, how do you know whether a misconfiguration is going to put you at risk? And how to identify where your gaps are? The good thing about the cloud is that you can configure it in any number of ways to fit your organization’s needs.
The only problem is, it can be difficult to know the difference between a configuration that deviates from the norm but does not put your security at risk and one that could lead to a breach.
If a misconfiguration could lead to any of the following situations, then it’s considered critical:

• Can be leveraged in a direct data breach
• Can be leveraged in a more complex attack
• Enables trivial attacks on an AWS console
• Reduces or eliminates critical visibility

How to detect and solve misconfiguration in the next post.