S3 bucket has event notifications enabled

Check ID: s3_bucket_event_notifications_enabled
Provider: AWS
Service: s3
Severity: LOW
Categories: logging
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets define a notification configuration that publishes bucket events (for example s3:ObjectCreated:*, s3:ObjectRemoved:*) to a destination. The evaluation identifies buckets that lack any notification setup.

Risk

Missing notifications leaves object and bucket changes unseen, weakening integrity and availability oversight. Undetected deletions, policy drift, or replication issues can stall data pipelines (S3 to Lambda/SQS), slow incident response, and allow tampering or exfiltration to persist longer.

Recommendation

Enable S3 event notifications for relevant events (e.g., s3:ObjectCreated:*, s3:ObjectRemoved:*) and route to controlled destinations (SNS, SQS, Lambda, EventBridge). Use prefix/suffix filters, avoid recursive triggers, and enforce least privilege on targets. Pair with object-level logging for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-notification-configuration --bucket <BUCKET_NAME> --notification-configuration '{"EventBridgeConfiguration": {}}'

# Enable S3 event notifications via EventBridge
resource "aws_s3_bucket_notification" "<example_resource_name>" {
  bucket = "<example_resource_name>"

  eventbridge {} # Critical: enables EventBridge delivery, satisfying notifications enabled
}

# CloudFormation: Enable S3 event notifications via EventBridge
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      NotificationConfiguration:
        EventBridgeConfiguration: {}  # Critical: turns on EventBridge notifications, making notifications enabled

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_event_notifications_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has default server-side encryption (SSE) enabled S3 bucket has server-side encryption with AWS KMS

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires