3 ms·
"It should be emphasized that a public bucket is not a risk created by Amazon but rather a misconfiguration caused by the owner of the bucket." So not really a
by gregd 14y ago
"It should be emphasized that a public bucket is not a risk created by Amazon but rather a misconfiguration caused by the owner of the bucket."
So not really a hole so much as it's configured that way. Title implies that this is a breach of some kind, which it's not.
- roberto 14y agoYeah, what's the point of this article? Public buckets are public, who would guess?!
- techinsidr 14y agoSeems to be really about misconfiguration and serving as a reminder for developers to check permissions on AWS buckets. While some data is obviously stored in public bucks for a reason, it's clear that much of the data Rapid7 was able to find in the "open" buckets was not intended to be made available to the public. It's not a security flaw with AWS, but an administrative oversight really, but at least a good reminder for everyone to go check their buckets :)
- mikeash 14y agoThe point seems to be that this is a really common misconfiguration and you should probably double-check to make sure you did yours right.