An EC2 instance attempted to enumerate S3 bucket
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect when an EC2 instance makes an API call to AWS to list all of the S3 Buckets.
Strategy
This rule lets you monitor CloudTrail to detect a ListBuckets API call with the session name prefixed with i-. A session name prefixed with i- typically indicates that it is an EC2 instance using an Instance Profile to communicate with other AWS services, which is a common attacker technique to see the full list of S3 buckets in your AWS account.
Triage and response
Determine if the EC2 instance should be making this API call.
- If not a legitimate user/application, rotate the credentials, verify what else may have been accessed and open an investigation into how this instance was compromised.
- If a legitimate user/application on the EC2 instance is making the
ListBuckets API call, consider whether this API call is really needed.
Changelog
18 March 2022 - Updated rule severity and rule name.
