Before
A security or cloud operations team would manually review CloudTrail events, identify the user, bucket, region, and timestamp, and determine whether the bucket should be restricted. They would then notify the appropriate channel and apply the public-access settings separately if remediation was approved.
How it works
- Receive and validate the CloudTrail event to identify a matching S3 public-access change.
- Extract the affected bucket, region, user, and timestamp, then send an approval-based alert to the designated Slack channel.
- Apply the public-access block policy when a reviewer selects the block option; otherwise, leave the bucket open.
Workflow details
- Event monitoring: The workflow receives an event through a webhook connected to an SNS subscription and checks whether it represents a public-access configuration change for an S3 bucket.
- Event enrichment: It structures the CloudTrail information to identify the user who made the change, the affected bucket, its AWS region, and the event timestamp.
- Approval notification: It posts these details to a designated Slack channel with two actions: block public access or leave the bucket open.
- Policy enforcement: If the recipient selects the block option, the workflow applies the S3 public-access block settings. If the recipient chooses to leave the bucket open, no blocking action is taken.
What changed
Matching public-access changes now produce a structured Slack alert with the relevant event context and an explicit remediation decision. The policy update is executed automatically after approval, while the human decision to block or leave the bucket open remains in place.
Work removed
Reviewing matching CloudTrail events one by one, looking up the affected user, bucket, region, and timestamp, composing and sending the notification, and manually applying the S3 public-access block policy after approval.
Expected outcome
For each matching event, at least four event-detail lookups and one notification-composition step are automated, while approved remediation can be applied without a separate manual policy-update procedure.
