Skip to content
HackIndex logo

HackIndex

S3 Bucket Enumeration and ACL Review

2 min read May 24, 2026

S3 enumeration covers both unauthenticated access on public buckets and authenticated access using valid credentials. A bucket may be private to anonymous requests but fully readable with any AWS credentials.

List All Buckets

┌──(kali㉿kali)-[~]
└─$ aws s3api list-buckets --profile $PROFILE --query 'Buckets[*].{Name:Name,Created:CreationDate}' --output table

List Bucket Contents

┌──(kali㉿kali)-[~]
└─$ aws s3 ls s3://$BUCKET --recursive --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws s3 ls s3://$BUCKET --recursive --no-sign-request
┌──(kali㉿kali)-[~]
└─$ aws s3 sync s3://$BUCKET ./loot/$BUCKET --no-sign-request

Bucket ACL

┌──(kali㉿kali)-[~]
└─$ aws s3api get-bucket-acl --bucket $BUCKET --profile $PROFILE

Dangerous grantee URIs: http://acs.amazonaws.com/groups/global/AllUsers (world-readable/writable), http://acs.amazonaws.com/groups/global/AuthenticatedUsers (any AWS account).

Bucket Policy

┌──(kali㉿kali)-[~]
└─$ aws s3api get-bucket-policy --bucket $BUCKET --profile $PROFILE | jq '.Policy | fromjson'

Public Access Block

┌──(kali㉿kali)-[~]
└─$ aws s3api get-public-access-block --bucket $BUCKET --profile $PROFILE 
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": false,
        "IgnorePublicAcls": false,
        "BlockPublicPolicy": false,
        "RestrictPublicBuckets": false
    }
}

All four false means no public access protections. If any are true, public access is blocked even if ACL or policy allows it.

Finding Sensitive Files

┌──(kali㉿kali)-[~]
└─$ aws s3 ls s3://$BUCKET --recursive --profile $PROFILE | grep -iE "\.(env|pem|key|pfx|p12|bak|sql|tar|gz|zip|conf|config|json|yml|yaml|tf|tfvars|csv)$"
┌──(kali㉿kali)-[~]
└─$ aws s3 cp s3://$BUCKET/$KEY ./loot/ --profile $PROFILE