How to Detect and Alert on Public S3 Buckets
A security engineer needs to ensure that an Amazon S3 bucket is not publicly accessible. Which AWS service can be used to continuously monitor and alert if the bucket becomes public?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
(AWS Config) is correct because AWS Config has managed rules such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that can evaluate S3 bucket policies and ACLs, continuously monitor configurations, and trigger alerts via Amazon SNS when a bucket becomes public. Option A (AWS CloudTrail) is wrong because CloudTrail records API calls but does not evaluate resource configurations. Option C (AWS Trusted Advisor) provides best-practice checks but does not offer continuous monitoring and alerting for configuration changes. Option D (Amazon GuardDuty) focuses on threat detection, not configuration compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity against your S3 bucket, including PutBucketPolicy, PutBucketEncryption, and PutPublicAccessBlock calls, but it never evaluates whether those configurations meet your security requirements. Instead of checking for compliance or drift, CloudTrail simply produces an immutable audit log for forensic and governance purposes. The service lacks rule definitions, compliance scoring, and any automated remediation to keep the bucket aligned with standards.
- ✓
AWS Config
Why this is correct
AWS Config continuously records the configuration state of your S3 bucket and evaluates it against managed rules such as s3-bucket-public-read-prohibited, s3-bucket-encryption-enabled, and s3-bucket-versioning-enabled. When a bucket configuration drifts from the expected baseline, AWS Config marks the resource noncompliant and can trigger remediation via Systems Manager Automation or alert you through Amazon SNS. This native configuration governance is precisely what is needed to ensure the bucket remains compliant, not merely observed or protected.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor offers security checks for S3 buckets, such as identifying buckets with open access permissions or missing logging, but these checks run on a periodic cycle and lack continuous, event-driven evaluation. Trusted Advisor does not support custom rules that map to your specific compliance requirements, nor does it provide configuration timelines, compliance history, or integration with automated remediation workflows. It is best for one-off and periodic recommendations, not for actively ensuring a bucket's configuration remains compliant over time.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty analyzes S3 data events and CloudTrail management events to detect malicious behavior such as unusual access patterns, credential abuse, or potential data exfiltration from your bucket. It does not evaluate the bucket's configuration settings—like encryption, public access blocks, or lifecycle policies—against a desired state. GuardDuty is a threat detection service, not a configuration assessment tool, so it cannot verify or enforce compliance of the bucket's setup.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.