Skip to content

IBM Cloud Object Storage

454 indexed

IBM Cloud Object Storage (COS) exposes both an IAM model and a legacy ACL model. Exposure usually comes from buckets created in an IBM Lite account where the developer enabled "public access" to share assets between trials.

IBM Cloud Object Storage exposure data

454
Total tracked
454
Currently open
2026-08-12: 4552026-09-05: 454

Aggregate figures only. See the full open-buckets data across all providers.

Common misconfiguration class

COS regional endpoints under `*.cloud-object-storage.appdomain.cloud` will serve directory listings when the bucket policy grants `Reader` to the `PublicAccess` group. The console hides this toggle behind two tabs.

Real-world impact

Public Reader returns the object list and bodies. PII spills, hardcoded keys, and unintended backup exposure are the typical findings.

Remediation

  • Remove `PublicAccess` from the bucket's IAM access policy.
  • Use a CRN-scoped service ID for app access instead of broad role grants.

URL patterns

IBM Cloud Object Storage buckets typically resolve under hostnames like:

  • example.s3.us-south.cloud-object-storage.appdomain.cloud

Check a specific IBM Cloud Object Storage URL

Paste any IBM Cloud Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.

Open the Viewer

Own a listed IBM Cloud Object Storage bucket?

If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.

Submit takedown request