Cloud Storage Object Discovery MITRE ATT&CK T1619
Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.
Infrastructure Setup
First, we establish the cloud storage environment by provisioning Amazon S3 buckets with intentionally weak or overly permissive security controls to simulate a realistic cloud exposure scenario. In mature AWS environments, services such as AWS Config, AWS Security Hub, IAM Access Analyzer, and AWS CloudTrail help organizations detect policy deviations, publicly accessible bucket misconfigurations, disabled encryption, and regulatory compliance violations related to cloud storage resources
Upload Enterprise Artifacts
Enterprise prefixes and sensitive storage objects were uploaded to simulate realistic organizational cloud storage patterns that may become attractive targets during adversary discovery activity.
The Risk
From an adversary perspective, publicly accessible or weakly secured cloud storage becomes an attractive target for discovery and enumeration activity. Misconfigured Amazon S3 buckets can unintentionally expose sensitive organizational data including internal documentation, financial records, backup archives, configuration files, security logs, and credential-related artifacts. In many environments, attackers specifically search for exposed cloud storage resources because they often provide valuable insight into an organization’s infrastructure, operational workflows, and security posture.
After identifying accessible cloud storage resources, an attacker may begin recursively enumerating bucket contents to identify organizational prefixes, sensitive object names, backup archives, configuration artifacts, or credential-related files that could support further access, persistence, privilege escalation, or data exfiltration activity. Even when object contents are not immediately accessible, bucket structure, naming conventions, and visible object keys alone can provide valuable reconnaissance information that helps adversaries prioritize follow-on targeting and attack paths within the environment.
Example API Calls
ListBuckets - Enumerate accessible S3 buckets
ListObjectsV2 - Recursively enumerate bucketcontents
GetObject - Retrieve accessible storage objects
GetBucketPolicy - Review bucket access permissions
GetBucketAcl - Identify public or overly permissive access controls
Regulatory & Security Control Considerations
This lab highlights the risks associated with publicly accessible or weakly secured Amazon S3 storage. Industry security frameworks and cloud security benchmarks recommend implementing controls that restrict unauthorized object discovery, enforce least privilege access, and continuously monitor cloud storage configurations for exposure risks.
The Center for Internet Security CIS AWS Foundations Benchmark specifically recommends:
ensuring S3 Block Public Access is enabled
restricting public read and write access to buckets
enabling centralized logging and monitoring
enforcing least privilege IAM permissions
monitoring cloud storage activity through audit logging
Similarly, National Institute of Standards and Technology NIST 800-53 guidance emphasizes:
Access Control (AC)
Audit & Accountability (AU)
Configuration Management (CM)
System & Information Integrity (SI)
to reduce the risk of unauthorized cloud storage exposure, object discovery, and sensitive data access.
Failure to implement these controls may increase the likelihood of adversary enumeration activity aligned with MITRE ATT&CK T1619: Cloud Storage Object Discovery.
Conclusion
This lab demonstrated how exposed or weakly secured Amazon S3 storage can become a valuable target during cloud discovery activity. Using valid AWS credentials and real-world tooling, the attacker was able to authenticate to AWS, enumerate accessible S3 buckets, recursively identify stored objects, and retrieve sensitive-looking files from the environment.
While this simulation was controlled, the techniques reflect behavior commonly seen during real cloud reconnaissance and post-compromise activity. Misconfigured bucket permissions, excessive IAM access, disabled logging, or publicly exposed storage can provide attackers with visibility into an organization’s internal structure, operational data, backups, and configuration artifacts.
From a defensive standpoint, organizations should continuously monitor cloud storage environments for unauthorized enumeration activity, public exposure risks, and policy deviations using services such as AWS CloudTrail, AWS Config, AWS Security Hub, and IAM Access Analyzer. Proper access controls, least privilege IAM policies, centralized logging, and continuous posture management remain critical to reducing the risk of cloud storage discovery and unauthorized data access within AWS environments.
