Zero-Trust AWS S3 Public Access Remediation Engine

This Python script audits Amazon S3 bucket configurations across target cloud environments using boto3, detecting dangerous public permissions exposed via ACLs or bucket policies. Internally, it queries bucket status attributes via get_public_access_block and get_bucket_policy_status, comparing returned state trees against baseline access policies and invoking put_public_access_block to programmatically force universal public access restrictions.

Securing object storage against inadvertent exposure is mandatory for compliance with standards such as SOC 2 and PCI-DSS. SecOps teams invoke this script via AWS Lambda on CloudTrail bucket creation events or run it continuously as a cron daemon to execute automated posture enforcement without manual operator intervention.

Automated remediation can disrupt legitimate public assets, such as static frontend hosts or distribution endpoints, if exemption tagging is missing. The executing IAM role must follow strict least-privilege principles, limited exclusively to S3 configuration read and public block write actions. Unhandled AWS API rate limits during account-wide scans require exponential backoff implementations to avoid throttling.

> System.Execute()

import boto3
from botocore.exceptions import ClientError

def enforce_s3_public_block(bucket_name):
    s3 = boto3.client('s3')
    try:
        s3.put_public_access_block(
            Bucket=bucket_name,
            PublicAccessBlockConfiguration={
                'BlockPublicAcls': True,
                'IgnorePublicAcls': True,
                'BlockPublicPolicy': True,
                'RestrictPublicBuckets': True
            }
        )
        print(f"[+] Public access blocked successfully for bucket: {bucket_name}")
    except ClientError as e:
        print(f"[-] Failed to apply public block on {bucket_name}: {e}")

enforce_s3_public_block("my-target-production-bucket")

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-48DF06271FCF