# S3 Bucket Enumeration and ACL Review

> Enumerate exposed S3 buckets, assess bucket and object ACLs, identify misconfigurations like public read/write access, and map data exposure risks.

- **URL:** https://hackindex.io/platforms/aws/enumeration/s3/s3-bucket-enumeration-and-acl-review
- **Path:** AWS > Enumeration > S3
- **Up:** [S3](https://hackindex.io/platforms/aws/enumeration/s3.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

S3 enumeration covers both unauthenticated access on public buckets and authenticated access using valid credentials. A bucket may be private to anonymous requests but fully readable with any AWS credentials.

- Buckets with public ACLs granting `AllUsers` or `AuthenticatedUsers` access
- Public access block settings all set to `false` (no protection in place)
- Sensitive file extensions: `.env`, `.pem`, `.key`, `.sql`, `.tfvars`, `.bak`
- Bucket policies allowing cross-account access with `Principal: *`

## List All Buckets

```bash
aws s3api list-buckets --profile $PROFILE --query 'Buckets[*].{Name:Name,Created:CreationDate}' --output table
```

## List Bucket Contents

**Authenticated**

```bash
aws s3 ls s3://$BUCKET --recursive --profile $PROFILE
```

**Unauthenticated (public bucket)**

```bash
aws s3 ls s3://$BUCKET --recursive --no-sign-request
aws s3 sync s3://$BUCKET ./loot/$BUCKET --no-sign-request
```

## Bucket ACL

```bash
aws s3api get-bucket-acl --bucket $BUCKET --profile $PROFILE
```

Dangerous grantee URIs: `http://acs.amazonaws.com/groups/global/AllUsers` (world-readable/writable), `http://acs.amazonaws.com/groups/global/AuthenticatedUsers` (any AWS account).

## Bucket Policy

```bash
aws s3api get-bucket-policy --bucket $BUCKET --profile $PROFILE | jq '.Policy | fromjson'
```

## Public Access Block

```bash
aws s3api get-public-access-block --bucket $BUCKET --profile $PROFILE
# {
#     "PublicAccessBlockConfiguration": {
#         "BlockPublicAcls": false,
#         "IgnorePublicAcls": false,
#         "BlockPublicPolicy": false,
#         "RestrictPublicBuckets": false
#     }
# }
```

All four `false` means no public access protections. If any are `true`, public access is blocked even if ACL or policy allows it.

## Finding Sensitive Files

```bash
aws s3 ls s3://$BUCKET --recursive --profile $PROFILE | grep -iE "\.(env|pem|key|pfx|p12|bak|sql|tar|gz|zip|conf|config|json|yml|yaml|tf|tfvars|csv)$"
```

**Download a file**

```bash
aws s3 cp s3://$BUCKET/$KEY ./loot/ --profile $PROFILE
```