s3 objects are private by default. Someone had to manually change the bucket permissions or upload each object and explicitly state they should be world-readabl

s3 objects are private by default. Someone had to manually change the bucket permissions or upload each object and explicitly state they should be world-readable. This case is more user error than anything. I believe they are also starting to mail customers whos buckets are marked world-readble just to remind them there could be a security problem if they didn't mean to do this.