Revoking Public S3 Bucket Access Automatically
A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?
Quick Answer
EventBridge is the right choice because the requirement is not just detection but automatic remediation, and EventBridge is built to react to an event the instant it happens and immediately invoke a target like Lambda to take corrective action. Because CloudTrail records the PutBucketPolicy API call whenever a bucket's policy changes, EventBridge can match that event type in near real time and trigger a Lambda function that inspects the new policy and reverts anything granting public access, closing the exposure window automatically without a human in the loop. The other paths fall short on part of the requirement: S3 event notifications only fire on object-level activity like object creation, so they never see a policy change; CloudWatch Logs with a metric filter and alarm can detect a pattern and send a notification, but an alarm by itself only notifies, it cannot take corrective action; and while AWS Config can flag a bucket as non-compliant against a public-access rule, remediation still requires wiring in a Lambda function or Systems Manager Automation document, so Config alone is a detection layer, not the full serverless auto-remediation loop. When a scenario calls for something to happen automatically and immediately in response to a specific API call, look for an event-driven trigger paired directly with a compute target that performs the fix, rather than a monitoring or alerting-only service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy
Amazon EventBridge (option B) can detect S3 bucket policy changes via CloudTrail (e.g., PutBucketPolicy events) and invoke an AWS Lambda function to remove the public policy, providing automatic remediation. Option A is incorrect because S3 event notifications on ObjectCreated only respond to object-level events, not bucket policy changes. Option C is incorrect because CloudWatch Logs with a metric filter and alarm can only send notifications, not directly remediate the bucket policy. Option D is incorrect because while AWS Config can detect non-compliant buckets with the managed rule 's3-bucket-public-read-prohibited', automatic remediation typically requires a custom Lambda function or Systems Manager Automation, and the option specifies Systems Manager, which is not as serverless-native as using Lambda directly; moreover, the combination described does not automatically revoke access without additional components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 event notifications on ObjectCreated events to invoke a Lambda function
Why it's wrong here
S3 event notifications are for object-level events, not bucket policy changes.
- ✓
Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy
Why this is correct
EventBridge captures API calls from CloudTrail and triggers Lambda to revert the public policy.
- ✗
Amazon CloudWatch Logs with a metric filter and alarm to trigger an SNS notification
Why it's wrong here
CloudWatch Logs can alert but cannot automatically remediate without additional services.
- ✗
AWS Config with managed rule 's3-bucket-public-read-prohibited' and auto-remediation via Systems Manager
Why it's wrong here
Config can detect and auto-remediate, but the question requires serverless; Systems Manager Automation is serverless, but Config is the trigger. However, EventBridge is more direct for real-time API calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Which AWS service can be used to evaluate bucket policies against a defined rule and trigger an automated response?
easy- A.Amazon GuardDuty
- B.AWS CloudTrail
- C.Amazon Inspector
- ✓ D.AWS Config
Why D: AWS Config rules can evaluate S3 bucket policies against defined rules and trigger automated remediation actions. Option A is incorrect because Amazon GuardDuty is a threat detection service, not for evaluating bucket policies. Option B is incorrect because AWS CloudTrail is for auditing API calls, not real-time resource evaluation. Option C is incorrect because Amazon Inspector is for vulnerability assessment on EC2 instances, not S3 bucket policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.