Briefing 01 · AWS · S3 · CloudFront · IAM
Your Bucket Is Private. Your Data Isn't.
Six real ways data leaks from S3 buckets that look locked down, from public objects to CloudFront and leaked keys, and how to close each one.
A bucket that says not public in the S3 console can still leak data. That label checks the bucket. Your data can also leave through objects, CDNs, links and credentials.
The six leaks
- Public object in a private bucket. With ACLs enabled, one object can grant
AllUsers: READwhile the bucket looks clean. - The CloudFront front door. The bucket is private, but the policy lets CloudFront read
bucket/*, so CloudFront serves every file to anyone who finds the path. - The whole file list. Teams grant CloudFront
s3:ListBucketto get 404s instead of 403s. With no default root object, the root URL lists every file. - Presigned links that travel. A link valid for 7 days gets pasted into chat, tickets and emails, and lands in proxy logs. Every copy is a working key.
- “Authenticated Users.” This ACL grantee means any AWS account in the world, not your users.
- Keys in code. Access keys committed to a repository let an attacker copy a private bucket. They don’t break in; they log in.
How to check your account today
Open IAM Access Analyzer and review every bucket shared publicly or with outside accounts. Then work through the field guide on this page.