<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cloud-storage-lifecycle-policies
description: >-
  Audit cloud storage lifecycle policies across AWS S3, GCS, and Azure Blob
  for insecure retention, missing encryption, public access, versioning gaps,
  and compliance violations in data lifecycle management.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - s3
  - gcs
  - azure-blob
  - lifecycle-policy
  - data-retention
  - encryption
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1530"]
---

# Auditing Cloud Storage Lifecycle Policies

## Overview

Audit cloud storage lifecycle policies across AWS S3, GCS, and Azure Blob for insecure retention, missing encryption, public access, versioning gaps, and compliance violations in data lifecycle management.

Mode: `[MODE: BLUE]` — Audit storage security. `[MODE: PRIVACY]` — Assess data retention compliance.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI, gcloud CLI, or az CLI configured | Required |
| Read access to storage account configurations | Required |
| Compliance requirements documented (retention periods) | Required |

## Key Concepts

### AWS S3 Bucket Audit

```bash
# Check bucket encryption
aws s3api get-bucket-encryption --bucket BUCKET

# Check public access block
aws s3api get-public-access-block --bucket BUCKET

# Get lifecycle configuration
aws s3api get-bucket-lifecycle-configuration --bucket BUCKET

# Check versioning status
aws s3api get-bucket-versioning --bucket BUCKET

# List buckets without encryption
for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  aws s3api get-bucket-encryption --bucket "$bucket" 2>&1 | \
    grep -q "ServerSideEncryptionConfigurationNotFoundError" && \
    echo "UNENCRYPTED: $bucket"
done
```

### GCS Bucket Audit

```bash
# Check bucket IAM
gsutil iam get gs://BUCKET

# Get lifecycle policy
gsutil lifecycle get gs://BUCKET

# Check public access
gsutil publicAccessPrevention get gs://BUCKET
```

### Azure Blob Audit

```bash
# Check storage account encryption
az storage account show --name ACCOUNT --query encryption

# Get lifecycle management policy
az storage account management-policy show \
  --account-name ACCOUNT --resource-group RG
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/auditing-cloud-storage-lifecycle-policies-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Auditing Cloud Storage Lifecycle Policies Detection
id: 50ff4296-cd49-4120-9471-e3a6c5864a1f
status: experimental
description: Detects suspicious activity related to auditing cloud storage lifecycle policies techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1530
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Cloud Storage Lifecycle Policies Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1530 |

## Verification

- [ ] All buckets have server-side encryption enabled
- [ ] Public access blocked at account and bucket level
- [ ] Lifecycle policies enforce compliant retention periods
- [ ] Versioning enabled for critical data buckets
- [ ] MFA Delete enabled for sensitive versioned buckets
- [ ] Access logging enabled for audit trail

## References

- [AWS S3 Security Best Practices](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)
- [GCS Security Overview](https://cloud.google.com/storage/docs/gsutil/commands/iam)
- [Azure Blob Storage Security](https://learn.microsoft.com/en-us/azure/storage/blobs/security-recommendations)
- [CIS AWS Foundations Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
