← Back to the Cloud Bucket Exposure Checker
"Is this bucket exposed?" is really two independent questions on every major cloud storage provider: can a stranger enumerate what's inside it with no credentials (listing), and can a stranger download a file whose name they already know or guessed (read)? A provider can be configured to allow either alone, both, or neither. This tool checks listing only -- the request it sends is each provider's own bucket-listing endpoint, never a GET on an individual object. A clean "private" or "not-found" result here says nothing about whether a known object key is still downloadable.
A bucket policy statement (or a legacy ACL grant) names a specific action.
s3:ListBucket controls anonymous listing; s3:GetObject controls
anonymous reads of individual keys. A policy can grant one without the other. Block Public Access
has its own split: BlockPublicPolicy stops a new public policy statement
from taking effect, while RestrictPublicBuckets stops an existing public
policy from applying, at the bucket or account level. Removing a wildcard
s3:ListBucket statement does nothing to a separate s3:GetObject grant
sitting in the same document, or in an old ACL nobody has looked at since.
roles/storage.objectViewer grants both storage.objects.get (read) and
storage.objects.list (listing) together, so binding it to allUsers
opens both at once. A narrower custom role can grant just one of the two permissions, and older
projects sometimes carry exactly that. Bucket-level Public Access Prevention
(or the equivalent organization policy) blocks any public IAM binding outright -- the one GCS
setting that closes both at the same time. Reading the console's permissions list one binding at
a time, and stopping at the first one you remove, can leave the other in place.
A container's Public access level is one of three values:
| Setting | Anonymous listing | Anonymous read of a known blob URL |
|---|---|---|
Private | No | No |
Blob | No | Yes |
Container | Yes | Yes |
Setting Blob instead of Private for a container that needs public
downloads is a common, deliberate choice — and it means this checker's own probe (which calls the
listing endpoint, ?restype=container&comp=list) reports private
for a container that is still handing out every object's content to anyone who has, or guesses,
its URL. The account-level Allow Blob public access switch sits above the container
setting: disabling it blocks both Blob and Container levels
account-wide in one move, which is the one Azure setting that closes both at once.
This tool sends exactly one request, the listing endpoint, and classifies the response body:
a real ListBucketResult or EnumerationResults document means public
listing; an error body carrying a code like AccessDenied,
PublicAccessNotPermitted, or AuthorizationPermissionMismatch means the
provider denied the anonymous listing request. Either result is real evidence about listing —
and neither one is evidence about read. If you need to know whether a specific object is
downloadable, that is a separate request against that object's own URL, checked against a key you
already know rather than one this tool's listing just handed you.
Run the Cloud Bucket Exposure Checker against your own bucket or container to see today's listing verdict. Only run it against a target you own or are authorised to test.