Cloud securitymedium200 pts0 solves

Open Bucket Audit

A cloud team shared some reports from an S3 bucket "temporarily". You received the bucket policy, an object listing and a CloudTrail excerpt (synthetic). What was actually exposed to the whole internet?

Learning objectives

Read an S3 bucket policy, find overly permissive principals and prove exposure from access logs.

Instructions

Analyse bucket-policy.json, s3-listing.json and cloudtrail.json. The flag is part of the key of the publicly downloaded object.

Prerequisites: Basic AWS IAM/S3 concepts (principals, resources).

Flag format: cspk{...}

Files: bucket-policy.json (0.5 KB), s3-listing.json (1.3 KB), cloudtrail.json (1.2 KB) (download after registering)

Useful tools: Prowler ScoutSuite

References

AWS docs — Bucket policy examples
AWS docs — Blocking public access to S3

Write-up

The full write-up and learning takeaways unlock after you solve this challenge — spoilers stay hidden until then.