Apps with an Amazon S3 bucket

What this finding means

An Amazon S3 bucket referenced from an app is ordinary: it is where the app keeps assets, uploads or downloads. The reference is not the problem and is usually unavoidable.

We have recorded an S3 reference in 1,050 apps. What matters is which of S3's several independent access controls were left permissive.

Three layers decide who can read an S3 bucket

S3 access is the combination of object ACLs, the bucket policy, and Block Public Access, evaluated together. A bucket can be private by policy and still serve objects whose individual ACLs grant AllUsers, which is why auditing the policy alone misses exposures. Block Public Access overrides the other two, and it is the setting worth confirming first.

The distinction that matters most to how we report this is between listing and reading. s3:ListBucket lets a caller enumerate what is in a bucket; s3:GetObject lets them fetch an object they can already name. A listable bucket is far more exposed, because it hands over the index as well as the contents.

Our check is deliberately limited to the listing question. We ask whether the bucket returns an index to an unauthenticated caller — something only its owner can have configured — and we never request an object. That is the whole of what a critical severity on this finding means.

How to fix it

• Enable Block Public Access at the account level and then per bucket, unless a bucket exists specifically to serve the public web.
• Audit object ACLs separately from the bucket policy, and disable ACLs entirely with the bucket-owner-enforced setting where you can.
• Remove any policy statement with a Principal of "*" granting s3:ListBucket. Public read of named objects is sometimes intended; a public index almost never is.
• Serve genuinely public assets through CloudFront with origin access control rather than from a public bucket.
• Use presigned URLs for user-specific files instead of making a whole prefix readable.

How we detect it, and what we do not do

Bucket and host patterns are matched in the APK and recorded in redacted form. A reference is low severity on its own.

Escalation requires a single anonymous listing request that used no credential, followed no redirect and read at most a few kilobytes. We do not fetch objects, we do not test any key found in the app against the bucket, and we never store bucket contents. The finding records that the bucket answered an anonymous caller, and nothing beyond that.