The Sec Guy

Episode 01 · AWS · S3 · CloudFront · IAM

Your Bucket Is Private. Your Data Isn't.

Six real ways data leaks from S3 buckets that look locked down, from public objects to CloudFront and leaked keys, and how to close each one.

Premiering soon

This video goes live on YouTube shortly.

A bucket that says not public in the S3 console can still leak data. That label checks the bucket. Your data can also leave through objects, CDNs, links and credentials.

The six leaks

  1. Public object in a private bucket. With ACLs enabled, one object can grant AllUsers: READ while the bucket looks clean.
  2. The CloudFront front door. The bucket is private, but the policy lets CloudFront read bucket/*, so CloudFront serves every file to anyone who finds the path.
  3. The whole file list. Teams grant CloudFront s3:ListBucket to get 404s instead of 403s. With no default root object, the root URL lists every file.
  4. Presigned links that travel. A link valid for 7 days gets pasted into chat, tickets and emails, and lands in proxy logs. Every copy is a working key.
  5. “Authenticated Users.” This ACL grantee means any AWS account in the world, not your users.
  6. Keys in code. Access keys committed to a repository let an attacker copy a private bucket. They don’t break in; they log in.

How to check your account today

Open IAM Access Analyzer and review every bucket shared publicly or with outside accounts. Then work through the checklist on this page.