Thing is, S3 ACL is pretty ugly. UX is unpleasant and testing is terrible. It could be some accidental catch-all rule letting everyone in. I guess that the only

Thing is, S3 ACL is pretty ugly. UX is unpleasant and testing is terrible. It could be some accidental catch-all rule letting everyone in. I guess that the only lesson here is to set up an automated test that verifies whether the resource you wanted to block is actually blocked.