Scaleway Object Storage
Scaleway Object Storage is S3-compatible and hosted at `s3.<region>.scw.cloud`. Public exposure follows the standard S3 ACL pattern, with `public-read` being the dominant misconfig.
Scaleway Object Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
Scaleway's self-serve Europe-focused tier attracts many small operators learning object storage for the first time. Documentation is solid in English but ACL hardening is buried under the API reference, not surfaced in the quickstart.
Real-world impact
Public ACL exposes full bucket contents to anonymous callers; the S3-compatible `?list-type=2` enumeration applies.
Remediation
- Set the bucket ACL to `private` via `aws s3api put-bucket-acl --endpoint-url https://s3.<region>.scw.cloud`.
- Use Scaleway IAM applications for app credentials rather than account-wide API keys.
URL patterns
Scaleway Object Storage buckets typically resolve under hostnames like:
example.s3.fr-par.scw.cloudexample.s3.nl-ams.scw.cloud
Check a specific Scaleway Object Storage URL
Paste any Scaleway Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Scaleway Object Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request