Amazon S3 buckets define a notification configuration that publishes bucket events (for example s3:ObjectCreated:*, s3:ObjectRemoved:*) to a destination. The evaluation identifies buckets that lack any notification setup.
Risk
Missing notifications leaves object and bucket changes unseen, weakening integrity and availability oversight. Undetected deletions, policy drift, or replication issues can stall data pipelines (S3 to Lambda/SQS), slow incident response, and allow tampering or exfiltration to persist longer.
prowler aws --checks s3_bucket_event_notifications_enabled
Recommendation
Enable S3 event notifications for relevant events (e.g., s3:ObjectCreated:*, s3:ObjectRemoved:*) and route to controlled destinations (SNS, SQS, Lambda, EventBridge).
Use prefix/suffix filters, avoid recursive triggers, and enforce least privilege on targets. Pair with object-level logging for defense in depth.
Remediation
aws s3api put-bucket-notification-configuration --bucket <BUCKET_NAME> --notification-configuration '{"EventBridgeConfiguration": {}}'
- Open the S3 console and select your bucket
- Go to the Properties tab
- In Event notifications, find Amazon EventBridge and turn it On (Enable)
- Click Save changes
Source Code
Resource Type
AwsS3Bucket