DisasterLab
PlaybooksPrivate storage bucket becomes public
Datacritical35 minutes to prepare

Private storage bucket becomes public

Files intended for restricted access can be listed or downloaded without proper authorization.

01DetectConfirm the signal
02ContainStop more damage
03RecoverRestore control
04VerifyProve it works

What do you need right now?

Prepare before it happensRecover from this now

Your preparation

0 of 0 safeguards ready
0%
Continue the prevention checklist
Incident worksheet

Make the next decision with evidence

Remove unintended public access, determine which objects were reachable and requested, and prevent another policy, ACL, or signed-link bypass.

EvidenceDecisionActionProof

Capture before evidence disappears

  • Save the bucket policy, ACLs, public-access settings, identity policies, website configuration, CORS, replication, and recent configuration-change events.
  • Inventory objects, versions, metadata, sensitivity, tenant, creation time, public URL patterns, and whether listing was enabled.
  • Preserve access, CDN, WAF, search-engine, analytics, and data-event logs for the earliest possible public window.
  • Test exposure from a signed-out network and save headers, status, listing behavior, cache behavior, and a harmless sample object reference.

Decisions that change the response

QuestionAct whenAction
Block the whole bucket?Sensitive objects are reachable or the intended public subset cannot be isolated quickly.Enable account and bucket public-access blocks, then restore only reviewed public delivery.
Rotate embedded secrets?Objects contain tokens, keys, configuration, backups, or credentials.Revoke them at their issuers. Removing object access does not invalidate copied secrets.
Assume access without logs?The bucket was public and data events, CDN logs, or retention are incomplete.Scope reachable data conservatively and record the uncertainty in the notification decision.

Proof that recovery worked

  • Anonymous list, read, version, website, CDN-origin, and direct-object requests fail where they should.
  • Intended public assets still work only through the approved delivery path.
  • Every reachable object is classified and correlated with retained access evidence.
  • Policy-as-code and runtime alerts reject or detect a recreated public policy and ACL.

Controls to put in place

  • Enable account-level public-access blocking and organization policies that deny public storage.
  • Separate public assets from private customer data into different buckets and accounts.
  • Log object data events to a protected account and alert on policy, ACL, and exposure changes.
  • Use short-lived signed access with tenant-aware authorization and never expose storage credentials to clients.
Tabletop drill

Expose one harmless object in a sandbox bucket through each supported access mechanism. Detect it, preserve the policy change, block anonymous access, invalidate a CDN copy, and prove approved public assets still work.

Escalate when

Bring in the cloud provider, security responders, insurer, and privacy counsel when customer data, backups, credentials, identity documents, or unknown object sets were reachable or access logging is incomplete.

What this means

Customer uploads, exports, backups, media, or internal documents may have been accessible. Removing public access stops new exposure but does not show what was downloaded.

Warning signs

  • A public URL works without authentication.
  • Cloud security tooling reports public access or policy drift.
  • Access logs contain unknown bulk downloads or listing requests.
  • A customer or researcher reports an exposed file.

Recover now

First 15 minutes

  1. Preserve bucket policy, access-control, audit, and object-access logs.
  2. Block public access at the account and bucket level.
  3. Disable exposed sharing links, CDN origins, and credentials.
  4. Record the exposure window before changing more configuration.

Today

  1. Inventory exposed objects and the people or customers they concern.
  2. Review access logs and billing for downloads during the window.
  3. Rotate keys or signed-link secrets that could bypass the corrected policy.
  4. Get legal and security advice about notification duties.

Verify recovery

  • Anonymous listing and download attempts fail.
  • Authorized application access still works.
  • No alternate bucket, CDN, or signed URL remains public.
  • Exposure scope and notification decisions are documented.

Prepare now

Access

  • Organization-level public-access blocks are enabled where possible.
  • Applications use least-privilege identities rather than public buckets.

Backups and evidence

  • Data-access logs are enabled and retained outside the bucket.

Contacts and ownership

  • Every bucket has an owner, data classification, and intended audience.

Practice

  • Automated tests prove representative private objects reject anonymous access.

Common mistakes

  • Fixing the bucket but leaving the CDN public.
  • Assuming no report means no download.
  • Deleting logs or the bucket before investigation.

Sources

Last reviewed July 19, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.