Public S3 buckets: the most embarrassing, most common leak
It was not a sophisticated hacker — it was a checkbox. Why payroll and invoices still show up on Shodan and what to do in your AWS account today.
The Hacker News has a recurring genre: "company exposes X million records on public S3 bucket." AWS Security Blog publishes controls; still every month a company appears — sometimes with LatAm operations — with indexable sensitive documents. Not APT; Block Public Access disabled "temporarily" in 2019.
Blocking public access and scanning buckets
For SMBs using S3 for backups, web assets, or ERP exports: enable Block Public Access at account level, use explicit deny-public bucket policies, and scan with tools like Prowler or ScoutSuite before audit. A legacy marketing bucket should not live in the same account without data classification tags.
Understand public by policy vs legacy ACL. Rushed on-prem migrations leave readable objects nobody reviews. S3 inventory and analytics help find forgotten data; Macie adds classification if budget allows.
Rotate presigned URLs: short expiry, minimal permissions. Sharing an invoice link by email valid for a year is deferred leakage. For regulated Puerto Rico clients (health, financial), this crosses compliance lines fast.
What to do if data is already exposed
If you already exposed data: contain (close access), assess scope with access logs, notify under applicable law, and fix process — not just the bucket. Public shame on Krebs lasts longer than fines; local customer trust is lost in days.
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
