<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cloud-storage-misconfigurations
description: >-
  Detect and remediate cloud storage misconfigurations across AWS S3, Azure Blob
  Storage, and GCP Cloud Storage including public access, missing encryption,
  disabled logging, and overly permissive CORS policies.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - azure
  - gcp
  - s3
  - blob-storage
  - cloud-storage
  - public-access
  - encryption
  - misconfiguration
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1530"]
---

# Detecting Cloud Storage Misconfigurations

## Overview

Cloud storage misconfigurations are the leading cause of cloud data breaches. Public
buckets, missing encryption, disabled logging, and overly permissive CORS settings
expose sensitive data to unauthorized access. This skill provides multi-cloud detection
across AWS S3, Azure Blob Storage, and GCP Cloud Storage with automated remediation
guidance mapped to CIS benchmarks.

Mode: `[MODE: BLUE]` — Storage security posture assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI v2, Azure CLI, `gcloud`/`gsutil` configured | Required |
| AWS | `s3:Get*`, `s3:List*` permissions |
| Azure | `Storage Blob Data Reader`, `Reader` on storage accounts |
| GCP | `storage.buckets.list`, `storage.buckets.getIamPolicy` |
| Python 3.10+ with `boto3`, `azure-storage-blob`, `google-cloud-storage` | Required |

## Key Concepts

### AWS S3 Misconfiguration Detection

```bash
# Find buckets without public access block
for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  PAB=$(aws s3api get-public-access-block --bucket "$bucket" 2>&1)
  if echo "$PAB" | grep -q "NoSuchPublicAccessBlockConfiguration"; then
    echo "[CRITICAL] $bucket — No public access block"
  fi
done

# Find buckets with public bucket policy
for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  STATUS=$(aws s3api get-bucket-policy-status --bucket "$bucket" 2>/dev/null | jq -r '.PolicyStatus.IsPublic')
  [ "$STATUS" = "true" ] && echo "[CRITICAL] $bucket — Public bucket policy"
done

# Find buckets without encryption
for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  aws s3api get-bucket-encryption --bucket "$bucket" 2>&1 | grep -q "ServerSideEncryptionConfigurationNotFoundError" && \
    echo "[HIGH] $bucket — No default encryption"
done

# Check CORS configuration for overly permissive origins
for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  CORS=$(aws s3api get-bucket-cors --bucket "$bucket" 2>/dev/null | jq -r '.CORSRules[]?.AllowedOrigins[]' | grep -c '\*')
  [ "$CORS" -gt 0 ] && echo "[MEDIUM] $bucket — Wildcard CORS origin"
done
```

### Azure Blob Storage Detection

```bash
# Find storage accounts with public blob access enabled
az storage account list --query "[].{Name:name,PublicAccess:allowBlobPublicAccess,RG:resourceGroup}" --output table

# Find storage accounts without HTTPS-only enforcement
az storage account list --query "[?enableHttpsTrafficOnly==\`false\`].{Name:name,RG:resourceGroup}" --output table

# Check for storage accounts without encryption scope
az storage account list --query "[].{Name:name,Encryption:encryption.services.blob.enabled}" --output table

# Find containers with public access
for acct in $(az storage account list --query "[].name" --output tsv); do
  KEY=$(az storage account keys list --account-name "$acct" --query "[0].value" --output tsv 2>/dev/null)
  az storage container list --account-name "$acct" --account-key "$KEY" \
    --query "[?properties.publicAccess!='off' && properties.publicAccess!=null].{Name:name,Access:properties.publicAccess}" \
    --output table 2>/dev/null
done
```

### GCP Cloud Storage Detection

```bash
# Find publicly accessible buckets
for bucket in $(gsutil ls | sed 's|gs://||;s|/||'); do
  IAM=$(gsutil iam get "gs://$bucket" 2>/dev/null)
  echo "$IAM" | grep -q "allUsers\|allAuthenticatedUsers" && echo "[CRITICAL] $bucket — Public IAM binding"
done

# Check uniform bucket-level access
gsutil ls -L -b gs://$BUCKET_NAME 2>/dev/null | grep "Bucket Policy Only\|Uniform bucket-level access"

# Find buckets without default encryption key
for bucket in $(gsutil ls | sed 's|gs://||;s|/||'); do
  ENC=$(gsutil kms encryption "gs://$bucket" 2>/dev/null)
  echo "$ENC" | grep -q "No default" && echo "[MEDIUM] $bucket — No CMEK configured"
done
```

## Workflow

### Step 1: Multi-Cloud Storage Inventory

```bash
# AWS
aws s3api list-buckets --query 'Buckets[].Name' --output text | tr '\t' '\n' | wc -l

# Azure
az storage account list --query "length(@)"

# GCP
gsutil ls | wc -l
```

### Step 2: Automated Scan

```bash
node scripts/agent.js --provider aws --output /tmp/storage_misconfig.json
```

## Detection

```yaml
title: Cloud Storage Misconfigurations Detection
id: b35bce44-0617-4ef2-b8a9-7a14cc807ba2
status: experimental
description: Detects suspicious activity related to detecting cloud storage misconfigurations techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1530
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Storage Misconfigurations Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1530 |

## Verification

- [ ] All storage services have public access blocks enabled
- [ ] Default encryption configured on all buckets/containers
- [ ] No wildcard CORS origins on sensitive buckets
- [ ] Access logging enabled on all storage resources
- [ ] HTTPS-only enforcement enabled
- [ ] Lifecycle policies configured for data retention compliance
- [ ] Storage access reviewed via IAM Access Analyzer or equivalent

## References

- [CIS AWS Foundations Benchmark — S3 Controls](https://www.cisecurity.org/benchmark/amazon_web_services)
- [MITRE ATT&CK T1530 — Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
- [Azure Storage Security Recommendations](https://learn.microsoft.com/en-us/azure/storage/blobs/security-recommendations)
- [GCP Cloud Storage Best Practices](https://cloud.google.com/storage/docs/best-practices)
