4 ms·
This. It is actually quite difficult to make a bucket writable by anyone. I don't understand how it can be done accidentally.
by ficklepickle 6y ago
This. It is actually quite difficult to make a bucket writable by anyone. I don't understand how it can be done accidentally.
- Corrado 6y agoIn the past, S3 buckets were created with much less sane defaults and you didn't have the ability to unilaterally forbid any public access that you do today. Also, configuring Bucket Profiles is a confusing and hard to test situation. And if that weren't enough, S3 buckets also have ACLs (though they are deprecated) that represent yet another way to configure access to your buckets. So, from the confusing UX to the multiple permissions settings, I can easily see how a company could get in this situation. In fact, the problem is so bad that AWS has revised the whole S3 thing several times, with each new iteration more secure than the last. Unfortunately, that doesn't help the company that configured their buckets 5 years ago and haven't touched them since.