S3 Bucket Misconfiguration
Misconfigured S3 buckets can expose sensitive data to the public internet. Common misconfigurations include public ACLs, overly permissive bucket policies, and disabled encryption.
Overview
Amazon S3 bucket misconfigurations have led to some of the largest data breaches in history. Public buckets have exposed billions of records including PII, financial data, and healthcare records. AWS now provides S3 Block Public Access, but legacy configurations and human error continue to create exposure.
Types & Variants
Public Bucket
Bucket ACL or policy allows public read/write access.
Misconfigured Policy
Wildcard principals or actions grant excessive access.
Unencrypted Data
Sensitive data stored without server-side encryption.
Impact
Data breach, compliance violations, reputational damage, financial penalties.
Examples
Public Bucket Policy
{
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::bucket/*"
}Remediation
Enable S3 Block Public Access at account level. Use bucket policies with explicit deny. Enable server-side encryption. Use AWS Access Analyzer.
Enable S3 Block Public Access at account level
Audit bucket policies for wildcard principals
Enable default encryption for all buckets
Use AWS Access Analyzer regularly
Related SuperClue scanner checks
These scanner checks look for signs of S3 Bucket Misconfiguration. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works