Object storage is simple, cheap and frequently exposed. A misconfigured bucket can publish more data than any application breach.
How exposure happens
- A bucket policy grants
*principal read access. - A public access block is disabled for convenience.
- A presigned URL is shared too broadly or never expires.
- An application proxies objects without checking ownership.
- A backup or log bucket is world-readable by default.
Controls that matter
- Account-level public access block unless there is a documented reason.
- Bucket policies scoped to specific principals and actions.
- Encryption at rest with managed or customer keys.
- Access logging and monitoring for policy changes.
- Lifecycle rules so stale data does not live forever.
- Versioning and object lock for ransomware resilience.
Public bucket response
Step 1/2A monitoring alert shows a bucket with a policy granting `Principal: *` and `s3:GetObject` on all objects.
What is the first action?
Choose one option to continue.
Key takeaways
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.