S3 Security Is Flawed By Design | UpGuard

UpGuard details a persistent, large-scale problem of Amazon S3 misconfiguration that has led to thousands of exposed buckets and tens of millions of breached records. The report highlights two primary root causes— the misleading "any authenticated users" permission and the confusing interaction between ACLs and bucket policies—argues that AWS' incremental controls (like Block Public Access) reduce but do not eliminate risk, and recommends more fundamental product changes, such as separating public web hosting storage from always-private storage.