S3 bucket exposure

What it means

S3 bucket exposure is when an Amazon S3 storage bucket, or one of its files, can be read or listed by people who should not have access, often anyone on the internet. Buckets hold backups, uploads, exports, logs and static websites, so an open one can reveal a lot.

Buckets are private unless someone makes them otherwise. Exposure usually follows a policy that grants access to everyone, an old permission setting on the bucket or object, or a tool configured to make things public to get a feature working. The settings are easy to change and easy to forget.

Why it matters

What leaks depends on what was stored: customer documents, database dumps, keys, internal reports. Anyone who finds the address can download it, and automated scanners search for open buckets constantly. If personal data is inside, it can count as a data breach with notification duties.

Because nothing was broken into, there may be no alarm. The first sign is often a researcher's email or a customer's complaint. It is a common form of cloud misconfiguration, and a simple one to prevent. Closing it takes minutes once someone looks, but nobody looks unless it is on a list.

How it shows up

You meet it in file-upload features, backups, exports, log archives and static sites. Repeated causes include public-read policies added for a quick test, buckets named predictably after the company, and a public bucket used for private files because the code was simpler that way.

AWS provides Block Public Access settings at account and bucket level, and new buckets have them on by default. Keep them on, grant access by role, and serve private files through short-lived signed links. Review bucket policies and list your buckets regularly. Test from outside, without credentials, to see what a stranger can read.