Lesson 2.3: Exposed cloud storage
Publicly readable storage buckets are one of the most common causes of cloud data breaches: a policy or permission that allows 'everyone' turns private files into a public website. They usually start as a quick way to share something. In the lab you check every Northwind bucket, find the reports bucket opened 'temporarily' for an auditor months ago, prove from the outside that anyone can list and download payroll data, close it with Block Public Access, remove the policy, and confirm that outsiders are now refused while Northwind's own access still works.
17 min
You will learn to
- Explain how storage becomes public
- Read a bucket policy
- Test access as an anonymous outsider
- Apply Block Public Access
- Share data safely with pre-signed URLs
Key terms
- Bucket policy
- A resource policy attached to a bucket saying who may do what with it.
- Block Public Access
- Four S3 settings that override public ACLs and policies at bucket or account level.
- ACL
- Access control list: an older, per-object way to grant access, including to 'AllUsers'.
- Pre-signed URL
- A link signed with your credentials that gives access to one object for a limited time.
- Anonymous access
- Requests without any credentials, as an outsider or scanner makes them.
← Windows security events · All lessons · Hash functions →