Check ID: s3_bucket_shadow_resource_vulnerability
Provider: AWS
Service: s3
Severity: HIGH
Categories: trust-boundaries
Resource type: AwsS3Bucket

​
What this check verifies

Amazon S3 buckets using predictable service naming (e.g., aws-glue-assets-<account>-<region>, sagemaker-<region>-<account>) are identified and their ownership checked. Buckets tied to your account that match these patterns but are owned by another account-across regions-are surfaced as shadow-resource candidates.

​
Risk

Preclaimed buckets matching your account’s patterns let outsiders intercept service artifacts, causing:
  • Loss of confidentiality (templates, data exfiltration)
  • Compromised integrity (script/config injection RCE, privilege escalation)
  • Reduced availability (creation failures or redirected writes)

​
Recommendation

Apply defense in depth:
  • Preprovision and own required service buckets in all current and planned regions
  • Enforce least privilege so services write only to approved bucket names/ARNs
  • Use non-guessable names where you control naming
  • Monitor for look-alike buckets and separate duties for bucket creation vs. use

​
Remediation

# Terraform: pre-claim the predictable S3 bucket name to ensure your account owns it
resource "aws_s3_bucket" "<example_resource_name>" {
  bucket = "<FLAGGED_BUCKET_NAME>"  # Critical: create the exact bucket name reported by the check so it is owned by this account
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_shadow_resource_vulnerability. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks