Before
Security staff would likely run recurring searches for public S3 buckets, expand and review the results, and create Jira issues manually. They would then determine whether each bucket required the block policy, coordinate the AWS change, and copy the remediation status back into the issue.
How it works
- A scheduled trigger searches JupiterOne for public AWS S3 buckets and expands the results for processing.
- The workflow creates a Jira issue, adds remediation guidance, and evaluates the configured bucket and allowlist conditions.
- The appropriate branch applies or checks the public-access-block policy through S3 Control and records the resulting prompt or confirmation in Jira.
Workflow details
- Scheduled discovery: An emailhook trigger starts a scheduled search for public AWS S3 buckets in JupiterOne and expands the returned results for processing.
- Issue creation: For each relevant public-bucket result, the workflow creates a Jira issue and adds a remediation prompt instructing the team to apply a public access block policy.
- Automated evaluation: The workflow evaluates configured conditions, including the public-bucket allowlist, to determine whether the policy implementation path should be followed.
- Remediation: When the implementation branch applies, the workflow uses the S3 Control step to implement the public-access-block policy for the bucket, as described in the playbook note.
- Operational record: The workflow adds a Jira comment containing either the remediation prompt or confirmation of the policy action, creating a persistent record for follow-up.
What changed
The workflow now moves each scheduled finding from discovery to Jira issue creation and conditional remediation without requiring separate manual searches, issue drafting, or status copying. The relevant condition determines the remediation path, and Jira receives the prompt or confirmation as part of the same process.
Work removed
Running recurring public-bucket searches, expanding and reviewing results one by one, creating Jira issues, copying remediation instructions into issues, checking allowlist conditions, invoking the S3 public-access-block action, and posting status comments manually.
Expected outcome
Each scheduled run can replace at least one manual search-and-ticketing cycle while producing a consistent Jira record and a defined remediation path for public S3 bucket findings.
