unfortunately S3 bucket deleted

Question

My S3 bucket data was deleted without my knowledge.

I checked CloudTrail logs and found delete actions from an unknown IP address (US region).
I did not intentionally share my access keys or credentials.

Steps I already took:

* Disabled access keys
* Enabled MFA
* Reviewed IAM users

I need help with:

1. How to trace who performed this action
2. Is it possible to recover deleted S3 data?
3. How to prevent this in future?

Any guidance would be helpful.

Sedat SALMAN · Answer

**How to trace who performed this action**

Use CloudTrail and check the delete event details: (userIdentity, sourceIPAddress eventTime etc.)
this works if you have enabled CloudTrail events

**Is it possible to recover deleted S3 data?**

Only if Versioning was enabled before the deletion.

**How to prevent this in future?**

Enable S3 Versioning, enable CloudTrail data events for important buckets, use MFA if possible

unfortunately S3 bucket deleted

Add your answer

Relevant content