Expose a bucket deliberately, then detect it three ways

short · 50 min · Objective 2.2

Task

Create a public storage exposure in your own account and measure how long each of three detection methods takes to find it -- including the one that works when your inventory is wrong.

Steps

  1. Enable the provider's configuration recorder and a rule covering public storage, and confirm it is evaluating.
  2. Create a storage container and make it publicly readable with a harmless test object. Record the exact time in lab/exposure-log.csv as event,time,method.
  3. Record when each detection fires: the configuration rule, a scheduled posture query you run yourself, and an EXTERNAL check -- fetch the object anonymously from outside your account.
  4. Remove the exposure and record the time. Compute the exposure window and write it into lab/exposure-window.md.
  5. Apply an organisation-level guardrail preventing public access, attempt to make it public again, and capture the refusal in lab/exposure-prevented.txt.

Verify

awk -F, 'NR>1 {print $3}' lab/exposure-log.csv | sort -u | wc -l
grep -Ec '[0-9]+' lab/exposure-window.md
test -s lab/exposure-prevented.txt && echo "guardrail refused it"

Three distinct detection methods recorded with times, an exposure window computed, and a captured refusal from the guardrail. The guardrail is the point: detection measures the window, prevention removes it.

Notes

Delete the object and the container at the end. The external check is the one worth noticing -- it is the only method that does not depend on your own enumeration being complete, which is why researchers find exposures that well-run assessment programmes miss.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.