How to Detect and Alert on Public S3 Buckets
A security engineer is designing a solution to detect and alert on any S3 bucket that is publicly accessible. Which THREE services can be used together to achieve this?
Quick Answer
This scenario calls for detection and alerting, not prevention, so the right combination is AWS Config, Amazon CloudTrail, and AWS Security Hub working together rather than any single service acting alone. AWS Config continuously evaluates bucket policies against a managed rule such as s3-bucket-public-read-prohibited, so it can flag a bucket the moment its configuration becomes non-compliant. CloudTrail logs the underlying API calls, like PutBucketPolicy, that actually change a bucket's access settings, letting you build alerting around the specific action that granted public access. Security Hub ties these together by aggregating findings from Config, GuardDuty, and other sources into one centralized view, giving the team a single place to see and act on public-access issues rather than checking each service separately. The two options that don't belong fail for opposite reasons: S3 Block Public Access is preventive, it stops public access from being configured, but does nothing to detect or alert once something is already public, and VPC Flow Logs capture network traffic metadata, unrelated to bucket policy or ACL configuration. When a question specifically asks for detection and alerting rather than prevention, rule out purely preventive controls even when topically related, and look instead for a configuration evaluator, an API-level log source, and an aggregator that ties the findings together.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Security Hub
(AWS Security Hub) is correct because it can aggregate findings from other services like AWS Config and Amazon GuardDuty, providing a centralized view and alerting for S3 bucket public access issues. Option C (AWS Config) is correct because it can evaluate S3 bucket policies against a managed rule (e.g., s3-bucket-public-read-prohibited) to detect public access and trigger alerts. Option D (AWS CloudTrail) is correct because it logs S3 API calls such as PutBucketPolicy, and you can create CloudWatch Events or metric filters to alert on changes that grant public access. Option B (Amazon S3 Block Public Access) is incorrect; it is a preventive control that blocks public access but does not detect or alert on existing public buckets. Option E (Amazon VPC Flow Logs) is incorrect because it captures network traffic data, not S3 bucket policy changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Security Hub
Why this is correct
Aggregates findings from Config and other services.
- ✗
Amazon S3 Block Public Access settings
Why it's wrong here
This is a preventive control, not detection/alerting.
- ✓
AWS Config
Why this is correct
Can evaluate bucket policies for public access compliance.
- ✓
AWS CloudTrail
Why this is correct
Logs API calls that change bucket policies.
- ✗
Amazon VPC Flow Logs
Why it's wrong here
Flow logs track network traffic, not bucket policies.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to ensure that an Amazon S3 bucket is not publicly accessible. Which AWS service can be used to continuously monitor and alert if the bucket becomes public?
easy- A.AWS CloudTrail
- ✓ B.AWS Config
- C.AWS Trusted Advisor
- D.Amazon GuardDuty
Why B: (AWS Config) is correct because AWS Config has managed rules such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that can evaluate S3 bucket policies and ACLs, continuously monitor configurations, and trigger alerts via Amazon SNS when a bucket becomes public. Option A (AWS CloudTrail) is wrong because CloudTrail records API calls but does not evaluate resource configurations. Option C (AWS Trusted Advisor) provides best-practice checks but does not offer continuous monitoring and alerting for configuration changes. Option D (Amazon GuardDuty) focuses on threat detection, not configuration compliance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.