CASE 12STORAGE & DATA

Public S3 Bucket Remediation

An S3 bucket could be listed and read by anyone without credentials, through three separate open doors. I traced each one, closed all three, and confirmed public requests were denied while authenticated access still worked.

DOMAIN: Storage & data
PLATFORM: Amazon S3
SEVERITY: High
OUTCOME: Private again

TOOLS

AWS CLIAmazon S3S3 bucket policiesS3 ACLsS3 Block Public AccessAWS IAM access controls

RESULT

BEFORE~~Anyone could list and read~~

AFTERAccessDenied without credentials

Objective

I set out to find how an S3 bucket had been made public across its access-control layers, confirm what anyone could see without credentials, and make it private again without breaking authenticated access.

Scenario

A bucket, leaky-bucket, had been made public by mistake. Users with no AWS credentials could list its objects and download files. I needed to find exactly which settings allowed that, and fix them without cutting off legitimate access.

What I found

block-public-accessALL OFF

BlockPublicAcls:       false
IgnorePublicAcls:      false
BlockPublicPolicy:     false
RestrictPublicBuckets: false

FINDING 01HIGH

Block Public Access switched off everywhere

All four Block Public Access settings were off, both on the bucket and on the account, so nothing stopped public grants from taking effect.

bucket-policyWILDCARD

{ "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject" }

FINDING 02HIGH

A bucket policy for any principal

The bucket policy let anyone read any object.

FINDING 03HIGH

An ACL granting READ to AllUsers

Object ownership was BucketOwnerPreferred, so ACLs were active, and the bucket ACL granted READ to the AllUsers group. With no credentials at all I could list customer-records/, flag.txt and sample-data.txt, plus customer-records/export.csv inside.

The exposure did not come from one failure. Three layers were open at once, each a separate path to the data.

What I did

Found the bucket
I listed the buckets and saved the target name.
Checked every layer
I read the ownership controls, the bucket and account Block Public Access settings, the bucket policy and the ACL.
Tested as an outsider
I listed and downloaded objects with --no-sign-request to prove the access was real.
Closed all three doors
I turned on all four Block Public Access settings, deleted the public bucket policy, and reset the ACL to private.
Retested both ways
I repeated the unauthenticated requests, then checked authenticated access.

EVIDENCE

BASH

aws s3api put-public-access-block --bucket "$BUCKET_NAME" \
  --public-access-block-configuration \
  "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
aws s3api delete-bucket-policy --bucket "$BUCKET_NAME"
aws s3api put-bucket-acl --bucket "$BUCKET_NAME" --acl private

Validation

CHECK	RESULT
Block Public Access (all four)	`true`
Bucket policy	`NoSuchBucketPolicy`
Unauthenticated request to `flag.txt`	`AccessDenied`
Authenticated access	Still working

Before and after

CONTROL	BEFORE	AFTER
Block Public Access	All four `false`	All four `true`
Bucket policy	`Principal: "*"`	Removed
Bucket ACL	`AllUsers: READ`	`private`
Unauthenticated object access	Allowed	`AccessDenied`
Authenticated access	Allowed	Allowed

“S3 exposure can come through several independent layers, so an assessment has to check Block Public Access, the bucket policy, the ACL and real unauthenticated access, not just one setting.”

SKILLS IT PROVES

Cloud Security
Amazon S3 Security
S3 Bucket Policy Analysis
S3 ACL Analysis
Access Control
Data Protection
Vulnerability Remediation
AWS CLI

View my labs on GitHub