Otvoreni S3 bucketi: Kako cloud pogrešna konfiguracija izlaže milione zapisa

← Blog

Problem sa javnim S3 bucketima

Amazon S3 (Simple Storage Service) je najrasprostranjeniji cloud storage servis. Svaki bucket može biti konfigurisan kao javan ili privatan. "Javan" znači da bilo ko na internetu može listati sadržaj i preuzimati fajlove bez autentifikacije — samo znanjem URL-a bucket-a.

URL pattern je predvidiv: https://bucket-name.s3.amazonaws.com/ ili https://s3.amazonaws.com/bucket-name/. Postoje automatizovani alati koji skeniraju milione kombinacija i pronalaze otvorene bucket-e.

Realni primeri curenja

• Twitch (2021): 125 GB koda, internih alata, streamer plaćanja — otvoreni S3
• Capital One (2019): 100 miliona kreditnih prijava — pogrešno konfigurisan S3 bucket
• GoDaddy (2019): 19.000 klijentskih podataka u javnom bucket-u
• Verizon (2017): 14 miliona korisničkih zapisa u javnom S3
• Accenture (2017): Master ključevi, autentifikacioni tokeni, tajni ključevi u javnim bucket-ima

Zašto nastaju ove greške?

• Developer kreira bucket za testiranje i zaboravi da ga zatvori
• Default podešavanja u starim AWS nalogima su bila javna (AWS je ovo promenio 2018)
• Nerazumevanje razlike između "objekt ACL javan" i "bucket policy javan"
• Deljeni AWS nalog bez centralizovane sigurnosne politike
• Migracija sa drugog storage sistema bez provere permisija

Kako proveriti vaše S3 buckets

AWS Console

S3 dashboard prikazuje "Access" kolonu za svaki bucket: "Bucket and objects not public" je jedini siguran status.

AWS CLI

aws s3api list-buckets --query 'Buckets[].Name'
aws s3api get-bucket-acl --bucket ime-vašeg-bucket-a
aws s3api get-bucket-policy --bucket ime-vašeg-bucket-a

AWS Trusted Advisor i Security Hub

Ovi servisi automatski identifikuju javne bucket-e i upozoravaju vas.

Sigurna konfiguracija S3

1. Block Public Access (obavezno)

aws s3api put-public-access-block \
  --bucket ime-bucket-a \
  --public-access-block-configuration \
  "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

2. Bucket Policy — eksplicitni Deny

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::ime-bucket-a/*",
    "Condition": {
      "Bool": {"aws:SecureTransport": "false"}
    }
  }]
}

3. Server-Side Encryption (SSE)

Uključite enkripciju u mirovanju: SSE-S3 (AWS managed key) ili SSE-KMS (customer managed key za viši nivo kontrole).

4. S3 Versioning i MFA Delete

Versioning čuva istoriju fajlova i štiti od slučajnog brisanja ili ransomware napada koji brišu podatke.

5. CloudTrail logovanje S3 Data Events

Svaki pristup bucket-u mora biti logovan — ko, kada, koji fajl. CloudTrail Data Events za S3 su skupi ali neophodni za kritične bucket-e.

Shieldome Scout analizira javno dostupne subdomene i URL pattern-e koji ukazuju na izložene cloud resurse kao deo standardne procene.

← Blog

The Problem with Public S3 Buckets

Amazon S3 (Simple Storage Service) is the most widely used cloud storage service. Each bucket can be configured as public or private. "Public" means anyone on the internet can list contents and download files without authentication — just by knowing the bucket's URL.

The URL pattern is predictable: https://bucket-name.s3.amazonaws.com/. There are automated tools that scan millions of combinations and find open buckets.

Real-World Breach Examples

• Twitch (2021): 125 GB of code, internal tools, streamer payment data — open S3
• Capital One (2019): 100 million credit applications — misconfigured S3 bucket
• Verizon (2017): 14 million customer records in a public S3 bucket
• Accenture (2017): Master keys, authentication tokens, secret keys in public buckets

Why Do These Mistakes Happen?

• A developer creates a bucket for testing and forgets to close it
• Default settings in old AWS accounts were public (AWS changed this in 2018)
• Misunderstanding the difference between "object ACL public" and "bucket policy public"
• Shared AWS account without a centralized security policy

Secure S3 Configuration

1. Block Public Access (Mandatory)

aws s3api put-public-access-block \
  --bucket your-bucket-name \
  --public-access-block-configuration \
  "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

2. Server-Side Encryption (SSE)

Enable encryption at rest: SSE-S3 (AWS managed key) or SSE-KMS (customer managed key for higher control).

3. CloudTrail Logging for S3 Data Events

Every access to a bucket must be logged — who, when, which file. CloudTrail Data Events for S3 are expensive but essential for critical buckets.

Shieldome Scout analyzes publicly accessible subdomains and URL patterns that indicate exposed cloud resources as part of a standard assessment.