Lab: Auto-Remediating Non-Compliant S3 Buckets with AWS Config

In this lab, you will implement an event-driven configuration change. You will use AWS Config to monitor S3 bucket settings and automatically trigger AWS Systems Manager (SSM) Automation to remediate a bucket that has public access enabled, ensuring your infrastructure remains in a desired, secure state.

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges for AWS Config recorders.

Prerequisites

An AWS Account with Administrator access.
AWS CLI installed and configured with credentials.
Basic knowledge of IAM Roles and S3.
AWS Config should be initialized in your region (this lab provides commands to do so).

Learning Objectives

Configure an AWS Config Managed Rule to detect non-compliant resources.
Implement an automated remediation action using AWS Systems Manager.
Use Amazon EventBridge logic to bridge configuration changes to corrective actions.
Verify system state restoration after a policy violation.

Architecture Overview

Loading Diagram...

Figure 1 — Mermaid diagram

Architecture Breakdown (Visual)

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Step-By-Step Instructions

Step 1: Create a Non-Compliant S3 Bucket

We will create a bucket and explicitly allow public access to trigger our event-driven workflow.

bash

# Generate a unique name
BUCKET_NAME=brainybee-lab-config-$(date +%s)

# Create the bucket
aws s3api create-bucket --bucket $BUCKET_NAME --region <YOUR_REGION> --create-bucket-configuration LocationConstraint=<YOUR_REGION>

# Disable Public Access Block (to make it non-compliant)
aws s3api put-public-access-block \
    --bucket $BUCKET_NAME \
    --public-access-block-configuration "BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false"

▶Console Alternative

Navigate to

Create bucket

. 2. Name it

brainybee-lab-config-xxx

. 3. Uncheck

Block all public access

. 4. Click

Create bucket

Step 2: Deploy the AWS Config Rule

We will deploy a managed rule that checks if S3 buckets have public access blocked.

bash

# Deploy the managed rule
aws configservice put-config-rule \
    --config-rule '{"ConfigRuleName": "s3-bucket-public-access-prohibited", "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED"}}'

▶Console Alternative

Go to

AWS Config

Rules

Add rule

. 2. Search for

s3-bucket-level-public-access-prohibited

. 3. Click

Next

and

Add rule

Step 3: Configure Automated Remediation

Link the Config rule to the SSM Automation document AWS-ConfigureS3PublicAccessBlock.

bash

# Associate remediation
aws configservice put-remediation-configuration \
    --config-rule-name s3-bucket-public-access-prohibited \
    --target-id AWS-ConfigureS3PublicAccessBlock \
    --target-type SSM_CONTROLS \
    --parameters '{"BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}}, "BlockPublicAcls": {"StaticValue": {"Values": ["true"]}}, "IgnorePublicAcls": {"StaticValue": {"Values": ["true"]}}, "BlockPublicPolicy": {"StaticValue": {"Values": ["true"]}}, "RestrictPublicBuckets": {"StaticValue": {"Values": ["true"]}}}' \
    --automatic-remediation

[!IMPORTANT] The RESOURCE_ID parameter is a dynamic placeholder that AWS Config replaces with the actual bucket name when the rule triggers.

Checkpoints

Checkpoint 1: Rule Compliance Status

Wait 2-3 minutes for the Config recorder to run, then check the compliance status.

bash

aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-public-access-prohibited

Expected Result: The ComplianceType should initially be NON_COMPLIANT and then transition to COMPLIANT after remediation.

Checkpoint 2: S3 Resource Verification

Verify the bucket settings have been automatically changed to "Block All Public Access".

bash

aws s3api get-public-access-block --bucket <YOUR_BUCKET_NAME>

Expected Result: All four boolean values (BlockPublicAcls, etc.) should now be true.

Troubleshooting

Problem	Possible Cause	Fix
Rule stays "Insufficient Data"	Config Recorder is off	Run `aws configservice start-configuration-recorder --configuration-recorder-name default`
Remediation Fails	Missing IAM Permissions	Ensure the Config service role has `ssm:StartAutomationExecution` and `s3:PutBucketPublicAccessBlock` permissions
Bucket not detected	Regional Mismatch	Ensure the S3 bucket and the Config Rule are in the same AWS Region

Clean-Up / Teardown

To avoid charges, delete the resources created during this lab:

bash

# Delete the S3 Bucket
aws s3 rb s3://$BUCKET_NAME --force

# Delete the Config Rule (and its remediation configuration)
aws configservice delete-config-rule --config-rule-name s3-bucket-public-access-prohibited

# Optional: Stop Config Recorder (Only if you don't use Config for other things)
# aws configservice stop-configuration-recorder --configuration-recorder-name default

Stretch Challenge

Scenario: Instead of a managed SSM document, create a Custom Lambda Function that sends an SNS notification to the Security Team whenever a bucket is auto-remediated.

Hint: Use Amazon EventBridge to capture the Config Rules Compliance Change event where newEvaluationResult is COMPLIANT and the oldEvaluationResult was NON_COMPLIANT.

Cost Estimate

Service	Estimated Cost (Lab Duration)
AWS Config	~$0.003 per configuration item recorded
S3	Free Tier (negligible storage/requests)
SSM Automation	Free (for standard AWS owned documents)
Total	<$0.10 USD

Concept Review

Service	Role in this Lab
AWS Config	Acts as the continuous auditing engine; detects when configuration drifts from the policy.
SSM Automation	Provides the execution logic to modify infrastructure and enforce the "Desired State."
Event-Driven	The workflow is reactive (Event -> Detect -> Act) rather than scheduled (Polling).
Remediation	The act of returning a resource to compliance without manual intervention.

Lab: Auto-Remediating Non-Compliant S3 Buckets with AWS Config

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges for AWS Config recorders.

Prerequisites

An AWS Account with Administrator access.
AWS CLI installed and configured with credentials.
Basic knowledge of IAM Roles and S3.
AWS Config should be initialized in your region (this lab provides commands to do so).

Learning Objectives

Configure an AWS Config Managed Rule to detect non-compliant resources.
Implement an automated remediation action using AWS Systems Manager.
Use Amazon EventBridge logic to bridge configuration changes to corrective actions.
Verify system state restoration after a policy violation.

Architecture Overview

Loading Diagram...

Figure 1 — Mermaid diagram

Architecture Breakdown (Visual)

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Step-By-Step Instructions

Step 1: Create a Non-Compliant S3 Bucket

We will create a bucket and explicitly allow public access to trigger our event-driven workflow.

bash

# Generate a unique name
BUCKET_NAME=brainybee-lab-config-$(date +%s)

# Create the bucket
aws s3api create-bucket --bucket $BUCKET_NAME --region <YOUR_REGION> --create-bucket-configuration LocationConstraint=<YOUR_REGION>

# Disable Public Access Block (to make it non-compliant)
aws s3api put-public-access-block \
    --bucket $BUCKET_NAME \
    --public-access-block-configuration "BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false"

▶Console Alternative

Navigate to

Create bucket

. 2. Name it

brainybee-lab-config-xxx

. 3. Uncheck

Block all public access

. 4. Click

Create bucket

Step 2: Deploy the AWS Config Rule

We will deploy a managed rule that checks if S3 buckets have public access blocked.

bash

# Deploy the managed rule
aws configservice put-config-rule \
    --config-rule '{"ConfigRuleName": "s3-bucket-public-access-prohibited", "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED"}}'

▶Console Alternative

Go to

AWS Config

Rules

Add rule

. 2. Search for

s3-bucket-level-public-access-prohibited

. 3. Click

Next

and

Add rule

Step 3: Configure Automated Remediation

Link the Config rule to the SSM Automation document AWS-ConfigureS3PublicAccessBlock.

bash

# Associate remediation
aws configservice put-remediation-configuration \
    --config-rule-name s3-bucket-public-access-prohibited \
    --target-id AWS-ConfigureS3PublicAccessBlock \
    --target-type SSM_CONTROLS \
    --parameters '{"BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}}, "BlockPublicAcls": {"StaticValue": {"Values": ["true"]}}, "IgnorePublicAcls": {"StaticValue": {"Values": ["true"]}}, "BlockPublicPolicy": {"StaticValue": {"Values": ["true"]}}, "RestrictPublicBuckets": {"StaticValue": {"Values": ["true"]}}}' \
    --automatic-remediation

[!IMPORTANT] The RESOURCE_ID parameter is a dynamic placeholder that AWS Config replaces with the actual bucket name when the rule triggers.

Checkpoints

Checkpoint 1: Rule Compliance Status

Wait 2-3 minutes for the Config recorder to run, then check the compliance status.

bash

aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-public-access-prohibited

Expected Result: The ComplianceType should initially be NON_COMPLIANT and then transition to COMPLIANT after remediation.

Checkpoint 2: S3 Resource Verification

Verify the bucket settings have been automatically changed to "Block All Public Access".

bash

aws s3api get-public-access-block --bucket <YOUR_BUCKET_NAME>

Expected Result: All four boolean values (BlockPublicAcls, etc.) should now be true.

Troubleshooting

Problem	Possible Cause	Fix
Rule stays "Insufficient Data"	Config Recorder is off	Run `aws configservice start-configuration-recorder --configuration-recorder-name default`
Remediation Fails	Missing IAM Permissions	Ensure the Config service role has `ssm:StartAutomationExecution` and `s3:PutBucketPublicAccessBlock` permissions
Bucket not detected	Regional Mismatch	Ensure the S3 bucket and the Config Rule are in the same AWS Region

Clean-Up / Teardown

To avoid charges, delete the resources created during this lab:

bash

# Delete the S3 Bucket
aws s3 rb s3://$BUCKET_NAME --force

# Delete the Config Rule (and its remediation configuration)
aws configservice delete-config-rule --config-rule-name s3-bucket-public-access-prohibited

# Optional: Stop Config Recorder (Only if you don't use Config for other things)
# aws configservice stop-configuration-recorder --configuration-recorder-name default

Stretch Challenge

Scenario: Instead of a managed SSM document, create a Custom Lambda Function that sends an SNS notification to the Security Team whenever a bucket is auto-remediated.

Hint: Use Amazon EventBridge to capture the Config Rules Compliance Change event where newEvaluationResult is COMPLIANT and the oldEvaluationResult was NON_COMPLIANT.

Cost Estimate

Service	Estimated Cost (Lab Duration)
AWS Config	~$0.003 per configuration item recorded
S3	Free Tier (negligible storage/requests)
SSM Automation	Free (for standard AWS owned documents)
Total	<$0.10 USD

Concept Review

Service	Role in this Lab
AWS Config	Acts as the continuous auditing engine; detects when configuration drifts from the policy.
SSM Automation	Provides the execution logic to modify infrastructure and enforce the "Desired State."
Event-Driven	The workflow is reactive (Event -> Detect -> Act) rather than scheduled (Polling).
Remediation	The act of returning a resource to compliance without manual intervention.