---
name: rt-scenario-c002
description: "C-002: Object storage exposure assessment for S3/Azure Blob/GCS. Domain: cloud. Authorized scenario for public access review, sensitive data sampling, logging validation, and remediation."
---

# C-002: Object Storage Data Exposure

## Overview

Object storage frequently holds backups, exports, logs, application assets, and sensitive documents. Misconfigured public access or overly broad IAM can expose data at large scale.

| Field | Value |
|---|---|
| Domain | Cloud Storage |
| Objective | Validate storage exposure and data sensitivity |
| Required Access | Cloud inventory/read role or approved public review |
| Detection Risk | Low |
| Primary Impact | Sensitive data disclosure |

## Prerequisites

- Storage accounts/buckets/projects in scope.
- Sampling rules and data redaction requirements.
- Approval for public access checks.
- Logging review access if possible.

## Workflow

1. Inventory buckets/containers and owners.
2. Review public access blocks, ACLs, bucket policies, and IAM grants.
3. Review encryption, versioning, lifecycle, and logging.
4. Sample approved objects only.
5. Classify exposed data: secrets, backups, PII, logs, source code, reports.
6. Prioritize by exposure, sensitivity, and business owner.

## Risk Indicators

- Public listing.
- Public object read.
- Broad `allUsers` or equivalent grants.
- Cross-account wildcard access.
- Backup files in internet-accessible buckets.
- Logs containing tokens or credentials.

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Discovery | Discovery | Cloud Storage Object Discovery |
| Collection | Collection | Data from Cloud Storage |
| Exfiltration | Exfiltration | Exfiltration to Cloud Storage |

## Evidence

- Bucket/container name.
- Policy excerpt.
- Public access state.
- Redacted object sample metadata.
- Logging status.

## Remediation

- Block public access.
- Remove broad IAM grants.
- Encrypt sensitive storage.
- Add access logging and alerting.
- Move backups to restricted accounts.
- Add data classification and retention controls.

