3 ms·
This is actually very common (software setting public access). I think it's to reduce support burden on software developers. See mongo with no access control
by privateSFacct 8y ago
This is actually very common (software setting public access).
I think it's to reduce support burden on software developers.
See mongo with no access control at all, lots of plugins and apps that might serve something public go to ALL public etc etc.
They've had free bucket permission check tools out I think since at least February as well. I think that will continue.
- jrochkind1 8y agoNice, I didn't know about the free bucket permission check tools, that's good. Looks like here's the announcement: https://aws.amazon.com/about-aws/whats-new/2018/02/aws-trusted-advisors-s3-bucket-permissions-check-is-now-free/ https://aws.amazon.com/about-aws/whats-new/2018/02/aws-trust... Sounds like you can still only automate it (using AWS dashboard anyway) as "Business and Enterprise support customers." But yeah, simply being able to set a bucket as "never allow public access in here" makes a _lot_ of sense, an easy way to deal with "misbehaving" software components (whether the developers who wrote them believed it was misbehavior or not). In most of the web software I write these days, I make _nothing_ public in S3, but provide an endpoint that will HTTP redirect to a signed URL to grant access. It's a bit of extra work (cpu cycles for the software that is, relatively trivial for the developer), but makes it easier to keep track of what I've granted access to how and when.