---
title: "Amazon S3 Ransomware Defenses Cheat Sheet | Cybr"
description: "Learn how to effectively defend against Amazon S3 Ransomware with our cheat sheet."
url: https://cybr.com/cheat-sheets/amazon-s3-ransomware-defenses/
---

# Amazon S3 Ransomware Defenses

 [Cybr](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/)

[Fog Security](https://www.fogsecurity.io/) [Jason Kao](https://www.linkedin.com/in/kaojason/)

## Defense Techniques

### Prevention

IAM restrictions:

- Bucket Policies
- RCPs & SCPs
- IAM least privilege

Data Deletion Prevention:

- Object Lock
- Versioning

Refer to footnote \[1\] for examples and more info

### Detection

Monitor and Alerting:

- Monitor S3 activity via CloudTrail (including data events)
- Create CloudWatch alarms
- Set up Lambda functions for automated response

Audit:

- Monitor KMS Encryption Keys
- Perform regular security audits

### Recovery

Backup data:

- Cross-account with AWS Backup
- Isolate via IAM and separate encryption keys

Simulations:

- Simulate ransomware attacks
- Test recovery procedures regularly

## Testing & Tools

### RansomWhen

KMS-based S3 ransomware detection

Tool #1

- Enumerates identities that can lock S3 buckets using KMS
- Detects occurrences of S3 ransomware using KMS

GitHub: [https://github.com/Permiso-io-tools/RansomWhen](https://github.com/Permiso-io-tools/RansomWhen)

### Stratus Red Team

Cloud attack simulation framework

Tool #2

- Launch simulated cloud attacks
- Includes multiple S3 ransomware simulations

Website: [https://stratus-red-team.cloud](https://stratus-red-team.cloud/)

### Finders Keepers

KMS key resource finder

Tool #3

- Finds resources encrypted with a specific KMS key
- Helps determine the blast radius of compromised keys

Website: [https://github.com/FogSecurity/finders-keypers](https://github.com/FogSecurity/finders-keypers)

```
› python3 finders_keypers.py --keyarn \
  arn:aws:kms:us-east-1:123412341234:key/aaaaaaaa-aaaa-1111-aaaa-aaaa1111aaaa

Total Number of Resources encrypted with KMS Key Provided: 5
example-bucket-finderskeypers
vol-12341234123412345
vol-43214321432154321
arn:aws:dynamodb:us-east-1:123412341234:table/my-first-dynamodb-table
arn:aws:ssm:us-east-1:123412341234:parameter/sample-parameter
```

### YES3 Scanner

S3 Security Scanner

Tool #4

- Looks for potential S3 security issues related to access, encryption, and ransomware

Website: [https://github.com/FogSecurity/yes3-scanner](https://github.com/FogSecurity/yes3-scanner)

```
› python3 yes3.py --profile <name> --region <region>

YES3 SCANNER RESULTS
AWS Account: 123412341234
Account Settings
Account Block Public Access Overall Status: OK
Bucket Summary
Total Buckets: 14
Buckets potentially public: 3
fog-pub-sample-bucket | Public Method: ['acl']
fog-pub-sample | Public Method: ['policy', 'acl']
```

## Demo these tools with **Cybr’s 1-Click Deploy** Hands-On Labs

[**Encrypting S3 Data with SSE-KMS - AWS Console** Learn how to encrypt S3 data with SSE-KMS using the AWS Console](https://cybr.com/hands-on-labs/lab/encrypting-s3-data-with-sse-kms-aws-console/)[**S3 Ransomware Through Client-Side Encryption** Test S3 ransomware through client-side encryption in a safe environment](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-client-side-encryption/)[**S3 Ransomware through batch file deletion** Test S3 ransomware through batch file deletion in a safe environment](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-batch-file-deletion/)[**Securing S3 Against Ransomware with YES3** Use the YES3 scanning tool to discover S3 issues that could lead to ransomware](https://cybr.com/hands-on-labs/lab/securing-s3-against-ransomware-with-yes3/)

## Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

**Cybr**

**Add’l Sources and more info:** [\[1\] FogSecurity: Complete Guide to Ransomware Protection in S3 and KMS](https://www.fogsecurity.io/blog/the-complete-guide-to-ransomware-protection-in-s3-and-kms) [List of attack simulation tools](https://cybr.com/cheat-sheets/cloud-attack-simulations/) [Ransomware in Amazon S3: SSE-C (detection tips & tricks)](https://www.fogsecurity.io/blog/ransomware-in-aws-s3-sse-c)

**More AWS security cheat sheets:** [https://cybr.com/aws-cheat-sheets](https://cybr.com/tag/aws-security-cheat-sheets/)

[More cheat sheets](https://cybr.com/cheat-sheets/)