Detection is only half the battle
I intentionally made an Amazon S3 bucket less secure… just to watch AWS fix it.
It sounds like a terrible idea, and in production, it would be. But that was exactly the purpose of this project.
I wanted to build a security control that didn’t wait for an administrator to notice a risky configuration change. Instead, it would detect the event, restore the bucket’s security settings automatically, and notify me that remediation had already taken place.
AWS Event-Driven S3 Public Access Auto-Remediation Control Architecture
Project Structure
What This Project Taught Me About Cloud Security
The goal of this project was straightforward. I wanted to build a solution that would automatically restore an Amazon S3 bucket whenever someone disabled Block Public Access.
As the solution came together, I saw how CloudTrail, EventBridge, Lambda, and SNS each played a critical role in creating a fully automated security workflow. CloudTrail recorded the event, EventBridge routed it, Lambda restored the bucket’s security settings, and SNS delivered a notification. Each service had a specific responsibility, and together they formed a resilient event-driven security control.
Get Olodudeibukun’s stories in your inbox
Join Medium for free to get updates from this writer.
Detecting a problem is important, but the real value comes from building systems that can respond automatically before a small mistake has the chance to become a security incident.
By the end of the project, I wasn’t just deploying AWS resources with Terraform. I had built a security control that could detect, remediate, and report configuration changes on its own, and that experience gave me a new appreciation for what security automation can achieve in modern cloud environments.
Challenges and Troubleshooting
One issue I encountered during testing was that the S3 bucket was successfully remediated, but no SNS notification was delivered.
After reviewing the workflow, I discovered that the email subscription to the SNS topic was still in the Pending Confirmation state. Although Lambda successfully published the notification, Amazon SNS could not deliver it until the subscription was confirmed.
Once I confirmed the subscription through the verification email, subsequent remediation events generated email notifications successfully.
This troubleshooting exercise reinforced an important lesson: automated security workflows depend not only on correctly configured infrastructure but also on properly configured integrations between AWS services.
Conclusion
The real value of automation isn’t just detecting misconfigurations, it’s responding to them immediately. This project showed how event-driven AWS services can work together to automatically detect, remediate, and report security events, reducing the need for manual intervention. More importantly, it reinforced my belief that the strongest cloud security solutions are those that are secure by design, automated by default, and resilient enough to respond before a small mistake becomes a serious incident.
