S3 Sentry

Find the S3 buckets that would end up in a breach report.

S3 Sentry checks every bucket in an AWS account for public access, missing encryption and settings that make data impossible to recover, and maps each problem to NIST CSF controls.

Scan your own account

The sample scan uses a fictional company and runs entirely in your browser.

acme-retail, 6 buckets Ready
    Each square is one of 14 security checks run against that bucket. Critical High Medium Low Passed No result

    Scan your own AWS account

    A real scan by the same engine. It reads bucket settings only, never your files, and it can't change anything. Results are deleted after 24 hours.

    1. Get a one-time link

      Creates a private session and a secret only your account will hold.

    2. Deploy the read-only role

      Opens AWS CloudFormation with everything filled in. Tick the box that acknowledges IAM resources, then choose Create stack. It takes about a minute.

      Open CloudFormation
      Exactly what the role can do

      Read the configuration of your buckets: public access settings, policy and ACL status, encryption, versioning, object lock, logging and ownership. It can't list or read objects and has no write permissions. Only S3 Sentry's demo scanner can use it, and only with your session's secret.

      Read the template

    3. Start the scan

    4. Remove the role

      When you're done, delete the S3SentryLiveDemo stack in CloudFormation. That removes the only thing the demo created.

    What the scan covers

    S3 bucket and account-level S3 configuration in one AWS account: 14 checks from the open-source Prowler engine, each mapped to NIST CSF 1.1. Every check is scanned today. One-click fixes are being built in stages, and automatic undo isn't working yet for any of them.

    CheckOne-click fixCan be undoneWhat to know
    Bucket-level Block Public AccessBuilt, in testingFull
    Account-level Block Public AccessPlannedFullApplies to every bucket in the account.
    Bucket is publicly accessibleBuilt, in testingFullFixed by turning on Block Public Access.
    ACL allows public listingPlannedFull
    ACL allows public writesPlannedFull
    Policy allows public writesGuidance onlyNot applicablePolicy edits need a person to review them.
    ACLs disabled (owner enforced)PlannedFullCan break apps that still rely on ACLs.
    Default encryptionBuilt, in testingFullExisting objects stay as they are.
    Encrypted with a KMS keyPlannedFullNeeds a key you choose; adds KMS cost.
    VersioningPlannedPartialAWS lets you suspend versioning, never fully turn it off.
    Object LockGuidance onlyNoneAWS can't turn Object Lock off once it's on.
    MFA DeleteNot possibleNot applicableOnly the account's root user can enable it.
    Server access loggingPlannedFullNeeds a log bucket; adds storage cost.
    Policy requires HTTPSPlannedFullBlocks any client still using plain HTTP.

    Not covered yet

    • What's inside your files, such as personal or health data
    • IAM users, roles and access keys
    • Other AWS services: EC2, RDS, Lambda, CloudTrail and the rest
    • Threat detection on live traffic
    • Other clouds

    Not a compliance audit

    Findings map to NIST CSF controls to help you prioritize. They aren't a HIPAA, PCI DSS or SOC 2 assessment.

    How it works

    No code in your account

    You deploy one IAM role. S3 Sentry assumes it from its own account with a per-customer External ID, which blocks the confused-deputy attack, and a trust condition that admits only its two Lambda roles.

    Scheduled, serverless scans

    EventBridge triggers a container Lambda daily. It runs Prowler's S3 checks, maps each failure to NIST CSF, and stores findings in S3 Sentry's own DynamoDB table, never in your account.

    Fixes you approve by email

    The full version emails each finding with Fix and Ignore links signed with HMAC-SHA256. A link works once, expires in 24 hours and stops working after a newer scan. Current settings are saved to a vault before any change. The live demo is read-only, so it skips this step.

    Python, AWS Lambda (container image), EventBridge, DynamoDB, STS, SES, SSM Parameter Store, CloudFormation, Prowler.

    Want this watching your buckets?

    S3 Sentry is in private testing. Email me to get early access for your company's AWS accounts.

    Request early access