Cloud › Module 4 › Lesson 1
S3 Hygiene
S3 hygiene literacy names block public access, encryption, bucket policies, and ACL review — harden storage on YOUR $CLOUD_LAB, not stranger bucket hunting.
Visual · t31_s3_hygiene
S3 hygiene literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Buckets are not private by default in every legacy setup — literacy teaches account-level guards and object exposure checks on sandboxes you own.
S3 hygiene includes Block Public Access at account and bucket level, default encryption (SSE-S3 or KMS), least-privilege bucket policies, ACL review, versioning for recovery, and access logging to a dedicated audit bucket. Public ListBucket or GetObject on sensitive prefixes is a top breach class — defender fix is policy plus BPA, not downloading stranger data. Cyberlium writes S3 hygiene checklist on YOUR $CLOUD_LAB — apply to fictional lab buckets only. Next: CloudTrail Named.
1. S3 controls (named)
Block Public Access: four account/bucket switches blocking public ACLs and policies. Encryption: default SSE on new objects. Bucket policy: deny insecure transport, restrict principals. ACL: legacy — prefer policy; review for AllUsers grants.
On $CLOUD_LAB, write five-item S3 hygiene checklist for one fictional lab bucket.
Command guide
Try these commands — S3 controls (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
S3 security — https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html Block Public Access — https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html S3 encryption — https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/aws/s3-hygiene-checklist.md" <<'EOF'
# S3 Hygiene Checklist — YOUR ACCOUNT buckets only
- [ ] Block Public Access enabled at account level
- [ ] Bucket policies deny public principals
- [ ] Default encryption (SSE-S3 or SSE-KMS)
- [ ] Versioning for critical data
- [ ] Access logging to dedicated log bucket
- [ ] Lifecycle rules for retention
NEVER: curl/wget anonymous objects from stranger bucket names
EOFCommand — copy this
grep -E 'Block Public|NEVER|encryption' "$CLOUD_LAB/aws/s3-hygiene-checklist.md" curl -sS https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: S3 security (https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html); Block Public Access (https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html); S3 encryption (https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why S3 hygiene beats reactive takedowns
Public bucket scanners find misconfigs in minutes — prevention at account BPA and policy review stops exposure before indexers list objects. CSPM rules map directly to these controls.
Students verify BPA on personal sandbox — never enumerate stranger buckets.
3. Literacy ≠ stranger bucket exploitation
Forbidden: downloading objects from public buckets you do not own. Allowed: S3 hygiene card — five controls with pass/fail self-check on $CLOUD_LAB.
Ship: S3 hygiene checklist for YOUR lab bucket. Next: CloudTrail Named.
4. What you ship: S3 hygiene checklist for $CLOUD_LAB
Five controls with pass/fail on lab bucket. $CLOUD_LAB named. NO stranger bucket access. chmod 600.
5. What you record before the next lesson
Date. S3 hygiene checklist. $CLOUD_LAB named. File t31-m04-l01-s3-hygiene.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Download stranger bucket data 'for research.' Disable BPA for convenience.
Right
Write S3 hygiene checklist for YOUR $CLOUD_LAB bucket. Next: CloudTrail Named.
Mission: harden S3 on YOUR lab bucket (paper check)
1) Name lab bucket fictional ID. 2) Checklist BPA, encryption, policy, ACL, logging. 3) Note one gap and fix intent. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Account-level BPA catches buckets you forgot to lock down.
Knowledge Check
APPLY: S3 Block Public Access primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Public bucket misconfigs are a common customer-side breach class.
True or False
Knowledge Check
APPLY: S3 hygiene literacy on Cyberlium avoids:
Multiple choice