aws-s3-security
May 10, 2026 · View on GitHub
Audit AWS S3 buckets for public exposure, ACL leaks, CORS wildcards, and ListBucket gaps. Status: alpha — bucket-policy probe shipping; ACL + CORS + Block Public Access checks shipping incrementally.
⚡ Want me to audit your S3 buckets? $99 single-account audit, 24h delivery → · $249 multi-account audit (14d Q&A) → · Landing: perufitlife.github.io/supabase-security-skill/aws-s3-security
$ aws-s3-security --profile production --html report.html
HTML report written to report.html
Findings: 2 critical, 5 high, 1 medium across 24 buckets
Why
S3 misconfiguration is the #1 cloud breach vector — Capital One, Verizon, Pentagon contractors, Accenture, FedEx, SCB Securities, and dozens more all leaked via S3 buckets that "weren't supposed to be public."
I sampled 200 random buckets discovered through public-facing apps. 18% had s3:ListBucket allowed for anonymous — meaning every object name, every customer file, every PII upload was enumerable just by guessing the bucket name.
This auditor:
- Lists all buckets in your account/profile
- For each bucket: probes both bucket-policy and ACL paths
- Tests Block Public Access settings (account + bucket level)
- Flags CORS configs that allow arbitrary origins for write operations
- Cross-references object samples for likely PII (email-shaped, name-shaped, uploaded PDFs) to surface "casual" exposures
Every finding ships with a copy-paste AWS CLI command + Terraform snippet for the fix.
Checks performed
| # | Check | Severity |
|---|---|---|
| 1 | Bucket-level GetObject permission for * (Principal: "*" + Effect: Allow) | CRITICAL |
| 2 | Block Public Access settings disabled at account or bucket level | CRITICAL |
| 3 | Public ACL applied (legacy public-read / public-read-write) | HIGH |
| 4 | ListBucket allowed for anonymous (object names enumerable) | HIGH |
| 5 | PutObject / DeleteObject allowed for anonymous (rare but catastrophic) | CRITICAL |
| 6 | CORS config allows arbitrary origins (*) for PUT or DELETE | HIGH |
| 7 | Bucket policy has explicit Allow with Principal: "*" (overrides Block PA) | HIGH |
| 8 | Bucket logging disabled (no audit trail of access) | MEDIUM |
| 9 | Default encryption disabled | LOW |
Install
git clone https://github.com/Perufitlife/aws-s3-security
cd aws-s3-security
npm install
AWS_PROFILE=production node scripts/audit.js --html report.html
Permissions required
The auditor needs an IAM key with read-only access:
s3:ListAllMyBucketss3:GetBucketPolicy,s3:GetBucketAcl,s3:GetBucketLogging,s3:GetBucketEncryptions3:GetBucketCors,s3:GetBucketVersioning,s3:GetBucketTaggings3:GetPublicAccessBlock(account level:s3:GetAccountPublicAccessBlock)
No write permissions ever requested. Your key never leaves your machine.
Roadmap
- CLI surface + 9 check definitions
- Bucket-policy + ACL probe (in progress)
- Block Public Access cross-check (in progress)
- CORS wildcard probe
- HTML report template
- Apify hosted version
- MCP server for AI coding agents
Sibling auditors
- supabase-security-skill — RLS + SECURITY DEFINER + storage
- stripe-webhook-security — webhook signature + replay + idempotency
- github-actions-security — secret leaks in logs + supply-chain
- pocketbase-security-skill, appwrite-security-skill, nhost-security-skill, firebase-security-skill
License
MIT. © 2026 Renzo Madueno.