amazon web services - Open S3 buckets vulnerabiltiy? -

i know bucket, want know open buckets vulnerability.

what open buckets? how confirm vulnerability?

thank in advance!!

there have been number of high profile leaks involving publically accessible s3 buckets. if i'm understanding question correctly, you're asking are, , how know if buckets vulnerable.

s3 buckets considered publically accessible, based on permissions of access controls. there 2 ways can make bucket public. first 1 using access control lists (acls). if bucket set public read, it's contents can downloaded able determine correct urls. second method use of bucket policy. bucket can made public using bucket policy such this example s3 documentation:

{   "version":"2012-10-17",   "statement":[     {       "sid":"addperm",       "effect":"allow",       "principal": "*",       "action":["s3:getobject"],       "resource":["arn:aws:s3:::examplebucket/*"]     }   ] } 

in case, "principal": "*" implies users, including anonymous users.

to check if buckets grant public access, can check each bucket 2 permissions. prevent buckets being made public, aws has released aws config rule preventing public read , write access.