Security · Difficulty 1 of 5 · 5 min
Open to the whole internet
External researchers report that they can list and download files from a data store without any credentials. Public-access settings are inconsistent across the account, and a second store with a similar name exists. Identify the unintended exposure and close it.
Where the symptom shows: S3
Take this challenge on a live account
A live AWS account, already broken, and a clock. You fix it with the provider's own console and command line, then read a report of how you worked. We host the cloud account. Nothing lands on your bill.
More challenges
- SecurityA protected route answers anyoneAPI Gateway · 5 min · level 1
- SecurityStorefront slows down under a traffic surgeElastic Load Balancing · 15 min · level 2
- SecurityInjection attempts reach the applicationElastic Load Balancing · 15 min · level 2
- SecurityInvestigators cannot reconstruct an intrusionCloudTrail · 45 min · level 4
- SecurityDefences look active but let everything throughElastic Load Balancing · 45 min · level 4
- SecurityA regulated data set fails its auditS3 · 90 min · level 5