IBM Cloud Object Storage
IBM Cloud Object Storage (COS) exposes both an IAM model and a legacy ACL model. Exposure usually comes from buckets created in an IBM Lite account where the developer enabled "public access" to share assets between trials.
IBM Cloud Object Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
COS regional endpoints under `*.cloud-object-storage.appdomain.cloud` will serve directory listings when the bucket policy grants `Reader` to the `PublicAccess` group. The console hides this toggle behind two tabs.
Real-world impact
Public Reader returns the object list and bodies. PII spills, hardcoded keys, and unintended backup exposure are the typical findings.
Remediation
- Remove `PublicAccess` from the bucket's IAM access policy.
- Use a CRN-scoped service ID for app access instead of broad role grants.
URL patterns
IBM Cloud Object Storage buckets typically resolve under hostnames like:
example.s3.us-south.cloud-object-storage.appdomain.cloud
Check a specific IBM Cloud Object Storage URL
Paste any IBM Cloud Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed IBM Cloud Object Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request