This is one in a series of short, simple J1 queries that will help you interrogate your AWS environments. The JupiterOne platform used to run these queries is free.
In this J1 Query example, we're going to be searching for people who are not the owners of an S3 bucket, but still have full control and meta-permissions for that bucket. This type of query allows us to analyze the permissions of various roles, groups and users, as well as seeing how buckets are protected and accessible via those permissions.
Cut-and-Paste Query
Here's the query you can use to cut-and-paste into your J1 instance. Watch JupiterOne technical expert, Akash Ganapathi, walk through the example query and then display the results in real time. If you find this useful, give us some contact info at the bottom of this page and we'll send you twice a month updates as we continue to explore various environments with JupiterOne. You'll also receive a personal invitation to a hands-on J1 Query Workshop in March.
FIND aws_s3_bucket as bucket
THAT ALLOWS as grant * as grantee
WHERE
grant.permission='FULL_CONTROL' and bucket.ownerId != grantee.canonicalUserId
Contribute your J1 Query to the Community
We will frequently be adding cut-and-paste J1 queries to our gallery. Join the community and every two weeks we'll send you a list of new queries. You can contribute your own queries for inclusion and examination in an upcoming article. Use the form below to join us.
