AWS S3
Amazon S3 is the most common source of public cloud-storage exposure on the internet. When bucket ACLs or policies grant the `AllUsers` group `s3:ListBucket` or `s3:GetObject`, anyone with the bucket name can enumerate or download its contents.
AWS S3 exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
Most exposed S3 buckets are misconfigured at creation time: a public bucket policy is attached so a static-site upload works, then never tightened. Block-Public-Access (BPA) is account-wide as of 2023, but accounts predating that rollout often retain legacy public ACLs that pre-date BPA defaults.
Real-world impact
Public ListBucket on an internal-data bucket means full directory enumeration. Public GetObject means anyone can download credentials, backups, customer data, source code, or whatever else was uploaded. Several Fortune-500 breaches in the last decade trace back to a single open S3 bucket.
Remediation
- Enable Block Public Access at the account level, which overrides legacy ACLs and prevents future regressions.
- Audit bucket policies for `"Principal": "*"` or `"Principal": { "AWS": "*" }` and remove unless the bucket is genuinely public.
- Set up AWS Config rule `s3-bucket-public-read-prohibited` (and the write equivalent) so future violations alert.
URL patterns
AWS S3 buckets typically resolve under hostnames like:
example-bucket.s3.amazonaws.comexample-bucket.s3.us-east-1.amazonaws.com
Check a specific AWS S3 URL
Paste any AWS S3 URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed AWS S3 bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request