S3 Security

More real data has walked out of AWS through open S3 buckets than through any clever exploit. Capital One, Verizon, Accenture, the Pentagon's intelligence contractor: all S3, all misconfiguration, none of them a software bug. A bucket is just a container for objects, but it has four separate systems that can each make it public, and people fight all four at once.

The four are ACLs, bucket policies, IAM policies, and Block Public Access. ACLs are the old way, an object-level grant list that AWS now discourages but that still exists everywhere. Bucket policies are JSON attached to the bucket, same shape as IAM policies. IAM policies grant access from the identity side. Block Public Access is the master switch that, when on, overrides the other three and refuses to serve anything public. Most modern leaks happen when someone turns that switch off "just to test" and forgets.

Test what a bucket actually allows

Public read of an object and public listing of the bucket are different permissions. A bucket can let you download a file whose exact key you know while refusing to list its contents, or it can hand you the whole index. Check both, plus write, which is the worst of all.

--no-sign-request is the flag that matters here. It tells the CLI to send the request with no credentials at all, so a success proves the bucket answers to anonymous callers, not just to you. Public write is a full compromise of whatever consumes that bucket: overwrite a JavaScript file a website loads and you have stored XSS on their site, or plant a malicious deployment artifact.

You can also just hit the REST endpoint in a browser. https://target-bucket.s3.amazonaws.com/ returns an XML listing if the bucket is publicly listable, and an AccessDenied XML body if it is not. That AccessDenied still confirms the bucket exists, which is useful.

Finding the buckets in the first place

Bucket names are global and DNS-visible, which makes them guessable. Real names cluster around the company: acme-backups, acme-prod-assets, acme-dev, acme-terraform-state. Permutation tools automate the guessing against wordlists.

$python3 s3scanner.py scan --bucket-list names.txt

The other tool worth knowing is awscli against a name list in a loop, but purpose-built scanners like S3Scanner and the classic bucket_finder.rb handle the existence-versus-access distinction for you and are faster. Grayhat Warfare indexes already-public buckets and their file listings, so search there before you scan anything, because the target's bucket may already be catalogued.

For defenders, the fix is boring and total: turn on Block Public Access at the account level, which forces it on for every bucket regardless of what individual policies say. Then use S3 Access Analyzer to flag any bucket policy that grants access outside your account. Do not audit bucket-by-bucket ACLs by hand. Let the account-level switch make public exposure impossible by default and treat any exception as an incident.