DAILY ANALYSIS
How to verify that an Amazon S3 bucket is private
Check effective S3 public access settings and verify that intended applications still work after closing public access.
Identify what could be exposed
A publicly readable bucket can expose reports, backups, or other objects that were intended for an application. Record the bucket owner, intended readers, data classification, and the access paths the application uses. Check both the bucket and any relevant S3 access points.
Check effective controls before changing them
S3 applies the most restrictive combination of applicable Block Public Access settings across the access point, bucket, and account. The account can also inherit an organization policy. For a private bucket, review all applicable settings and enable the required protections. Review the underlying policy and any ACLs separately because enabling Block Public Access does not rewrite existing policies or ACLs.
Test a denied request and an allowed request
In a hypothetical staging environment, a team places a harmless synthetic object in an owned bucket. It verifies that an unsigned request to the known object is denied, then reads that same object with the application's intended role and confirms that it exists and is accessible to the application. Record the tested path, timestamp, and result. Repeat the check for relevant access points and run the application smoke test.
Reconcile findings with the test
Review IAM Access Analyzer for S3 for public and cross-account findings. Findings can take time to update, especially after an account-level change, so compare their timestamps with the configuration change. Assign intended cross-account access to an owner and investigate unexpected grants.
Keep the evidence in scope
A denied request covers the object, access path, and time you tested. It does not establish whether objects were accessed before the change or whether another access path exposes them. If exposure may already have occurred, preserve available logs and route the case through incident response.