S3 Hygiene

S3 hygiene literacy names block public access, encryption, bucket policies, and ACL review — harden storage on YOUR $CLOUD_LAB, not stranger bucket hunting.

S3 Hygiene• Audio Walkthrough

00:00/03:28

Visual · t31_s3_hygiene

S3 hygiene literacy. $CLOUD_LAB only. Original Cyberlium.

Buckets are not private by default in every legacy setup — literacy teaches account-level guards and object exposure checks on sandboxes you own.

S3 hygiene includes Block Public Access at account and bucket level, default encryption (SSE-S3 or KMS), least-privilege bucket policies, ACL review, versioning for recovery, and access logging to a dedicated audit bucket. Public ListBucket or GetObject on sensitive prefixes is a top breach class — defender fix is policy plus BPA, not downloading stranger data. Cyberlium writes S3 hygiene checklist on YOUR $CLOUD_LAB — apply to fictional lab buckets only. Next: CloudTrail Named.

1. S3 controls (named)

Block Public Access: four account/bucket switches blocking public ACLs and policies. Encryption: default SSE on new objects. Bucket policy: deny insecure transport, restrict principals. ACL: legacy — prefer policy; review for AllUsers grants.

On $CLOUD_LAB, write five-item S3 hygiene checklist for one fictional lab bucket.

Command guide

Try these commands — S3 controls (named)

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, curl. Reference sites: S3 security (https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html); Block Public Access (https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html); S3 encryption (https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why S3 hygiene beats reactive takedowns

Public bucket scanners find misconfigs in minutes — prevention at account BPA and policy review stops exposure before indexers list objects. CSPM rules map directly to these controls.

Students verify BPA on personal sandbox — never enumerate stranger buckets.

3. Literacy ≠ stranger bucket exploitation

Forbidden: downloading objects from public buckets you do not own. Allowed: S3 hygiene card — five controls with pass/fail self-check on $CLOUD_LAB.

Ship: S3 hygiene checklist for YOUR lab bucket. Next: CloudTrail Named.

4. What you ship: S3 hygiene checklist for $CLOUD_LAB

Five controls with pass/fail on lab bucket. $CLOUD_LAB named. NO stranger bucket access. chmod 600.

5. What you record before the next lesson

Date. S3 hygiene checklist. $CLOUD_LAB named. File t31-m04-l01-s3-hygiene.txt chmod 600.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Download stranger bucket data 'for research.' Disable BPA for convenience.
Right: Write S3 hygiene checklist for YOUR $CLOUD_LAB bucket. Next: CloudTrail Named.

Hands-on Exercise