Skip to content
Shakeride

Guide · Updated

Public bucket exposure: how to find and close it in five minutes

Public exposure of a bucket rarely comes from a single setting. It comes from a grant somewhere that allows anonymous access, and from the guardrail that should have blocked it being switched off.

How a bucket becomes public

Anonymous access to Amazon S3 is granted by a bucket policy or an access control list that names everyone as a principal. S3 Block Public Access, at the account or bucket level, overrides those grants when it is on.

Confirm which bucket is exposed

Similar bucket names make it easy to fix the wrong one. Reproduce the report first: try to list or read the reported object without credentials, then check that bucket's settings rather than the one whose name looks right.

Close it, then keep it closed

Fix the exposure in the bucket, then make the next one harder.

  • Remove the grant that allows anonymous access.
  • Turn on Block Public Access for the bucket, and for the account if nothing needs to be public.
  • Serve genuinely public content through a distribution in front of the bucket rather than from the bucket itself.
  • Use IAM Access Analyzer to list buckets shared outside the account, and review it on a schedule.

All guides

Practise on a real failure

A live AWS account, already broken, and a clock. Fix it with the console and command line, then read a report of how you worked.

Start your first ride

Browse the challenge catalog