Back to Checks
aws

S3 bucket has event notifications enabled

s3_bucket_event_notifications_enabled
Service: s3Severity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsS3Bucket

Amazon S3 buckets define a notification configuration that publishes bucket events (for example s3:ObjectCreated:*, s3:ObjectRemoved:*) to a destination. The evaluation identifies buckets that lack any notification setup.

Prowler logoProwlerprowler-provider-aws

Risk

Missing notifications leaves object and bucket changes unseen, weakening integrity and availability oversight. Undetected deletions, policy drift, or replication issues can stall data pipelines (S3 to Lambda/SQS), slow incident response, and allow tampering or exfiltration to persist longer.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_bucket_event_notifications_enabled

Recommendation

Enable S3 event notifications for relevant events (e.g., s3:ObjectCreated:*, s3:ObjectRemoved:*) and route to controlled destinations (SNS, SQS, Lambda, EventBridge).

Use prefix/suffix filters, avoid recursive triggers, and enforce least privilege on targets. Pair with object-level logging for defense in depth.

Remediation

CLI

aws s3api put-bucket-notification-configuration --bucket <BUCKET_NAME> --notification-configuration '{"EventBridgeConfiguration": {}}'

Terraform

# Enable S3 event notifications via EventBridge
resource "aws_s3_bucket_notification" "<example_resource_name>" {
  bucket = "<example_resource_name>"

  eventbridge {} # Critical: enables EventBridge delivery, satisfying notifications enabled
}

NativeIaC

# CloudFormation: Enable S3 event notifications via EventBridge
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      NotificationConfiguration:
        EventBridgeConfiguration: {}  # Critical: turns on EventBridge notifications, making notifications enabled

Other

1Open the S3 console and select your bucket
2Go to the Properties tab
3In Event notifications, find Amazon EventBridge and turn it On (Enable)
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client


class s3_bucket_event_notifications_enabled(Check):
    """Ensure S3 Buckets have event notifications enabled

    This check will return a FAIL if the S3 Bucket does not have event notifications enabled.
    """

    def execute(self) -> list[Check_Report_AWS]:
        """Execute the s3_bucket_event_notifications_enabled check

        Iterates over all S3 Buckets and checks if they have event notifications enabled.

        Returns:
            list[Check_Report_AWS]: List of Check_Report_AWS objects
        """
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = (
                f"S3 Bucket {bucket.name} does not have event notifications enabled."
            )

            if bucket.notification_config:
                report.status = "PASS"
                report.status_extended = (
                    f"S3 Bucket {bucket.name} does have event notifications enabled."
                )

            findings.append(report)

        return findings

References