Yes, this really strikes at the heart of the "shared responsibility" model with using the cloud. We believe that cloud service providers should implement some c

Yes, this really strikes at the heart of the "shared responsibility" model with using the cloud. We believe that cloud service providers should implement some changes: 1. Check if the storage location (in this case s3 buckets) are being actively used at deletion time and warn the user. 2. Hold deleted s3 buckets for some time and monitor for incoming requests. In this case, the name should not be released for re-use and the previous owner should be notified. 3. Finally the ultimate fix is to establish a scope of ownership (another unique ID in the url that belongs only to your account and will never be reused). We're seeing more and more cloud services move to #3 but all the major storage services are affected due to their years old design and even things like PaaS platforms (*.herokuapp.com) are affected as well by this class of vulnerabilities.