← Back to the S3 Bucket Exposure Checker
Typing https://bucket-name.s3.amazonaws.com/ into a browser tab is a real, fast way
to spot the single obvious case: a plainly readable ListBucketResult. It is also the
method most developers already reach for first, and it genuinely works for that case.
| Check | Typing the URL by hand | This tool |
|---|---|---|
| Obvious public listing | Catches it | Catches it |
| ACL-based public read/write, with listing blocked | Not checked -- a browser tab only sees the listing endpoint | A separate GetBucketAcl request checks read and write grants independently |
| Distinguishing AllUsers from AuthenticatedUsers | Easy to read "AuthenticatedUsers" as "my own users" | Named explicitly as "any AWS account holder", flagged as its own finding |
| A bucket outside us-east-1 | Can hit the wrong regional endpoint and see a confusing error | Retries once against the region S3 itself reports in the response header |
| Repeatable in a nightly audit or CI | Manual, point-in-time | CLI returns a real exit code |
If you only need a one-off sanity check on a bucket name you already have open in a browser tab, looking is fine — it's free and you're already there, and it does catch the most common case (a plainly listable bucket). The gap this tool closes is coverage: the ACL check most people skip because it needs a second URL, the AuthenticatedUsers distinction most people don't know to look for, and an exit code a CI pipeline can act on.
Typing https://bucket-name.s3.amazonaws.com/ into a browser tab is a fast, real check for the single obvious case: an AccessDenied XML error means listing is blocked, and a ListBucketResult means it is not. That's genuinely useful and free -- but it only checks listing, and only from whichever region endpoint your browser's DNS happens to resolve first.
Three ways this scripted check catches and a quick manual look easily misses: (1) It only checks listing, not the ACL -- a bucket can block anonymous listing while its ACL still grants AllUsers read or write access to individual objects by direct URL. (2) A grant to AuthenticatedUsers looks, at a glance, like it might mean 'my own team' -- this tool names it explicitly as 'any AWS account holder' so it is never mistaken for a scoped grant. (3) A bucket outside us-east-1 commonly needs a region-specific endpoint; a browser hitting the wrong one can get a confusing redirect or error that looks like 'blocked' when it isn't actually confirmed either way.
A manual check is a point-in-time look at one bucket. A new bucket created from a script, a Block Public Access setting toggled off for a one-time migration and never reverted, or an ACL widened by a later object upload can reintroduce this exposure at any point. The CLI here returns a real exit code, so it can be wired into a nightly audit or a deploy pipeline, catching a regression the day it happens rather than the next time someone thinks to check by hand.