Object storage is convenient, durable, and unforgiving of misconfiguration. Most exposure incidents trace back to a small number of avoidable defaults.
Start from private
Ensure buckets are private by default and that public access is blocked at the account level, not just per-bucket. An account-wide guardrail survives a careless individual change.
Prefer identity over ACLs
Grant access through identity-based policies rather than object ACLs. ACLs scatter authorization across millions of objects and are hard to audit; policies centralize it.
Encrypt and log
Enable default encryption and access logging. Encryption limits the impact of a misrouted object; logging lets you answer “who accessed what” after the fact.
Detect drift
Continuously scan for buckets that become public and for policies that grant broad principals. Detection closes the gap between a mistaken change and its discovery.
Sample content created for development and testing.