The Invisible Footprint: How Anonymous S3 Requests Evade AWS Logging

Varonis Threat Labs discovered an evasive vulnerability that prevented anonymous S3 requests from being recorded in CloudTrail Network Activity events, sometimes producing no logs at all. This allowed attackers inside private VPCs to interact with external public buckets invisibly, and AWS has since updated CloudTrail in collaboration with Varonis to log anonymous API requests made to external S3 buckets #CloudTrail #S3

Keypoints

VTL found a vulnerability where anonymous S3 requests did not appear in CloudTrail Network Activity events, regardless of bucket permissions.
Anonymous requests from a VPC to buckets within the same account generated logs, while requests to external buckets generated no events in the source account.
If the target account’s VPC endpoint policy allowed access, the target account logged management/data events; if denied, the request was blocked at the network layer and no events were created in either account.
Attackers could exploit denied endpoint policies in a compromised account to interact with public buckets anonymously and evade detection by security teams.
Missing anonymous logs enable stealthy data exfiltration or malware downloads via VPC endpoints with no forensic trail for incident responders.
AWS and Varonis collaborated to change CloudTrail behavior so anonymous API requests to external S3 buckets via VPC endpoints are now logged as Network Activity events delivered to the VPC endpoint owner.
Recommended mitigations include applying least-privilege VPC endpoint policies, auditing bucket policies, and enabling alerts on policy changes.

MITRE Techniques

[None ] No MITRE ATT&CK techniques were explicitly referenced in the article.

Indicators of Compromise

[S3 bucket names ] No specific bucket names disclosed – no bucket names were provided in the report.
[Log entries / CloudTrail events ] General log types referenced (Network Activity, management/data events) – no concrete IOCs such as IP addresses, file hashes, domains, or filenames were published.