S3 Cloud Exposure
Find misconfigured cloud storage buckets linked to your domains before they become a data breach.
Misconfigured cloud object storage is one of the most common causes of enterprise data breaches. A developer creates a bucket for backups or static assets, sets it to public for a quick test, and never changes it back.
How detection works
RiskShelter generates and probes bucket names derived from your domain and organization patterns, then checks the access control configuration of each one.
Public Read (High/Critical): the bucket exists, is publicly owned, and anyone can list or download its contents without authentication.
Public Write (Critical): anyone can upload or overwrite files. This allows attackers to host malware, deface content, or inject files into your deployment pipeline.
Protected (Secure): the bucket exists and correctly blocks public access. No action needed.
Non-Existent: the name is unclaimed. Worth noting if it appears in your source code or DNS, as it could be registered by a third party.
How to fix it
Enable Block Public Access at the AWS account level: this prevents any individual bucket from being made public, even if someone sets a permissive ACL by mistake. Review existing bucket policies and ensure all access goes through authenticated IAM roles. If you have DNS records pointing to S3 endpoints, make sure the bucket still exists in your account to prevent subdomain takeover.