# S3 public: the logo bucket is how the backup goes public Source: https://ai.techclick.in/blog_aws_s3_public_mistake Markdown: https://ai.techclick.in/blog_aws_s3_public_mistake.md Publisher: Techclick Infosec Pvt Ltd Block Public Access at the account. Bucket policy vs ACL. Public for a logo becomes public for the backup. Access Analyzer. ## The ticket A researcher DMs a URL: tc-lab-app-logs/backup/pay-api.sql returns 200. The ticket that opened the bucket said “need the logo on the website.” Nobody scoped the policy to one prefix. Account Block Public Access was off “because the website.” Quick interview answer S3 Block Public Access is a guardrail at the account and the bucket. Four settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets. Account-level settings apply across buckets. ACLs are the old object/bucket grant model; bucket policies are the resource policy you should actually read. Object Ownership Bucket owner enforced disables ACLs. “Public for the logo” belongs in a dedicated public-assets design (or CloudFront), never on the logs/backup bucket. IAM Access Analyzer reports public and cross-account access — use it as evidence. Hero · one checkbox, whole bucket The internet does not honour your prefix intention. The policy does, or it does not. Lab data · dummy only Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10 . Dummy account ID. Not yours. ## Mental model Layer Job This lab Account Block Public Access Hard stop on public ACLs/policies On for 111122223333 Bucket BPA Same four switches per bucket On for tc-lab-app-logs Bucket policy Who can s3:* on this bucket/prefix AppEC2Role write; no Principal * ACL Legacy grants (AllUsers / AuthenticatedUsers) Disabled via Bucket owner enforced Access Analyzer Finds public / cross-account Must be quiet for logs Split the logo from the backup public assets logo only · intentional - tc-lab-app-logs private · BPA on Principal * on logs backup is now public If the logo must be public, it does not live with pay-api.sql. https://111122223333.signin.aws.amazon.com/console Training mock · not live AWS console VPC IAM S3 CloudTrail S3 → Block Public Access / Access Analyzer ### Account 111122223333 + tc-lab-app-logs Account BPA All four ON Bucket tc-lab-app-logs · BPA ON · Object Ownership: Bucket owner enforced Bucket policy Deny public · allow AppEC2Role on prefix · no Principal * ACL Disabled — do not grant AllUsers Access Analyzer No public finding on tc-lab-app-logs Cancel Save Public for the logo is not public for the backup. Training mock. ## How to choose Need Do Do not Website logo Dedicated public-assets path / CloudFront Principal * on the logs bucket App logs + backups Private + BPA + CMK (lesson 5) ACL public-read “for one file” Prove it is not public Access Analyzer + get-public-access-block Trust the folder name ## Runbook #### Side A — kill switch Account-level Block Public Access on. Confirm bucket-level on tc-lab-app-logs . Object Ownership: Bucket owner enforced. - #### Side B — policy Remove Principal * and any AllUsers ACL. Write a bucket policy for AppEC2Role only. Move logo.png out. - #### Side C — prove Access Analyzer is quiet. Anonymous GET fails. CloudTrail (lesson 7) data events tell you who already read it — that is incident scope, not optional colour. aws cli · public proof aws s3control get-public-access-block --account-id 111122223333 # BlockPublicAcls / IgnorePublicAcls / BlockPublicPolicy / RestrictPublicBuckets: true aws s3api get-public-access-block --bucket tc-lab-app-logs aws s3api get-bucket-policy --bucket tc-lab-app-logs aws s3api get-bucket-ownership-controls --bucket tc-lab-app-logs # ObjectOwnership: BucketOwnerEnforced aws accessanalyzer list-findings --analyzer-arn arn:aws:access-analyzer:ap-south-1:111122223333:analyzer/lab \ --filter '{"resource":{"eq":["arn:aws:s3:::tc-lab-app-logs"]}}' # empty public findings ## Four failures ### 1 · Public for the logo The policy was bucket-wide. The backup went with it. ### 2 · Account BPA off “for the website” Now every future bucket can be born public. Keep account BPA on; isolate the one public design. ### 3 · ACL public-read, policy looks clean You did not look at ACLs. Disable them. ### 4 · Closed the URL, skipped Analyzer + Trail You do not know who already copied pay-api.sql. Contain, then scope. ## How to prove it Close only when 1) Account and bucket BPA are on. 2) Analyzer has no public finding on tc-lab-app-logs. 3) Anonymous GET is 403. 4) You scoped CloudTrail data events if the object was live. ## Traps Belief Fact AuthenticatedUsers is “our account” It is any AWS-authenticated principal, not your org Folder “public/” is a security boundary Only the policy is BPA deletes the bad ACL It blocks the effect; still clean the ACL/policy ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Strongest single switch so new buckets cannot be born public? Account-level S3 Block Public Access A longer bucket name Disabling CloudTrail Opening sg-web Correct: a . Account BPA. Q2 “Public for the logo” on tc-lab-app-logs is dangerous because… S3 cannot host objects A bucket-wide Principal * publishes the backup too KMS forbids logos TGW blocks GET Correct: b . Same bucket. Q3 Prefer which access language on a modern bucket? AllUsers ACL Bucket policy + Bucket owner enforced (ACLs off) AuthenticatedUsers ACL as “private” User-data listing the objects Correct: b . Policy, not ACL. Q4 Tool that reports a public or cross-account bucket? IAM Access Analyzer A NACL VGW telemetry Instance metadata Correct: a . Analyzer. Q5 AuthenticatedUsers means… Only 111122223333 Any authenticated AWS principal — not ‘our staff’ Only AppEC2Role Only root Correct: b . Classic ACL trap. Q6 After you flip BPA, you still need to… Remove the public policy/ACL and scope who already read it Delete the org Disable Identity Center Peer every VPC Correct: a . Contain then scope. Check answers Reset AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview ## Sources - Amazon S3 — Blocking public access to your Amazon S3 storage . Related: AWS session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt