[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Attack Surface Management](/category/attack-surface-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Check your Amazon S3 permissions or Someone Else will.](/blog/check-your-amazon-s3-permissions-someone-will) Publish date June 30, 2025 {x} minute read # Check your Amazon S3 permissions or Someone Else will. [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) Nearly all large enterprises use the cloud to host servers, services, or data. Cloud hosted storage, like [Amazon's S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html), provides operational advantages over traditional computing that allow resources to be automatically distributed across robust and geographically varied servers. However, the cloud is part of the internet, and without proper care, the line separating the two disappears completely in [cloud leaks](/blog/what-are-cloud-leaks)— a major problem when it comes to [sensitive information](https://www.upguard.com/blog/sensitive-data). ## Background Despite being private by default, Amazon’s Simple Storage Service (S3) storage buckets are notorious for [being left unlocked to the public](https://www.itnews.com.au/news/aws-warns-users-about-open-s3-buckets-468737), even by some of the world’s largest companies. This can result in a massive [data breach](https://www.upguard.com/blog/data-breach), if the bucket was holding a corporate database, customer list, or other large collection of sensitive information. And it has. UpGuard researchers  found a slew of massive exposures among [publicly accessible Amazon S3 buckets](/breaches/spy-games-booz-allen-hamilton-pentagon). Although the [cloud misconfiguration](https://www.upguard.com/blog/cloud-misconfiguration) itself, a simple permission, is quite small, its implications can be disastrous. ## Automatically Validating S3 Configurations Why does this keep happening? Because organizations create S3 buckets, modify the default permissions, and later dump data into them without first validating their configurations. This happens for several reasons: the [S3 instance](/breaches/verizon-cloud-leak) was supposed to be temporary, the admin forgot to close out public access, the bucket was opened programmatically and the script didn’t set the correct permissions— many processes lead to the potential for oversight. The key is that S3 buckets, just like servers and network devices, need to be validated to ensure they are hardened. This crucial step grants the trust necessary to store sensitive corporate data in the cloud. [UpGuard](/) fully supports Amazon S3 nodes and automatically checks public permissions to ensure they are closed. This simple but critical check could be the difference between performing casual routine maintenance and handling a severe data breach on the front page of the news. UpGuard validates the public permissions for every S3 bucket added as a node, not just once at deployment, but continuously and automatically, notifying you only if something is left open. We hear a lot about [0-day](https://www.upguard.com/blog/zero-day) [exploit](/blog/exploit) prevention, advanced intrusion defenses, and other cutting edge cybersecurity technologies, but simply making sure S3 instances are secure to the public would likely prevent more breaches than all of those put together. ## AWS Procedure Using UpGuard Procedures, a thorough validation of AWS servers can be easily defined and automated, ensuring hardened configs like closed S3 permissions, and more importantly, surfacing misconfigurations immediately, allowing teams to correct them before a security researcher— or someone else— stumbles across them. Our UpGuard procedure can validate S3 buckets and EC2 configurations for AWS, so we’ll put together a few steps to do both and validate the whole surface area of our AWS presence. ### 1. Test S3 Public Access Our first step will validate all of the Amazon S3 buckets associated with our organization. We want to make sure first and foremost that public access is disabled, so we’ll set up checks for the AllUsers and AuthenticatedUsers groups which grant that access. If an S3 instance allows either group, it fails the test and we receive a notification. ### 2. Test EC2 Groups Next we want to check our EC2 servers' security groups and verify that they meet our company policy. We should follow [the principle of least privilege](/blog/principle-of-least-privilege), so administrative rights should be minimally dispersed, with continuous validation that other accounts have not been granted admin access. Likewise, public access should be limited to necessary ports, for example 443 and 80 for web.  ### 3. Test Asset Configurations As the final step of the procedure, UpGuard examines the assets themselves, looking for open ports, unsafe default configurations, unnecessary services and programs, patches and software versions, known [vulnerabilities](https://www.upguard.com/blog/vulnerability) and other critical information. UpGuard also captures AWS meta-data, allowing you to verify AWS specific settings as well, including [AWS permissions](/blog/caught-in-the-aws-tarpit). By measuring the servers against industry benchmarks like the Center for Internet Security’s critical security controls, we can shore up anything that could be used as a foothold later. ## Conclusion Amazon’s cloud storage offers a lot of value for digital enterprises, but it also presents a set of particular risks, which can lead to serious business problems if left unmitigated. The issue of unsecured S3 buckets gains visibility every day, as news stories relate the types of sensitive enterprise information left unattended in them. UpGuard’s [cyber resilience](https://www.upguard.com/blog/cyber-resilience) platform validates S3 configurations specifically for public permissions, but more importantly, can do so as part of a larger procedure that validates the entire AWS infrastructure. Cyber resilience means building security into the everyday work of IT operations. Automated processes, like our example of AWS maintenance with UpGuard, mitigate [cyber risk](/blog/cybersecurity-risk) through continuous validation. The few extremely sophisticated [cyber attacks](https://www.upguard.com/blog/cyber-attack) may occasionally succeed, but the vast majority of all attacks can be repelled through resilient operations. In the enterprise, it’s usually customer data at risk, and it’s customers who pay the price when that data is compromised. To maintain customer trust, companies must take responsibility as stewards of their information and do what they can to protect it. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)