this post was submitted on 07 Apr 2024
514 points (95.7% liked)
Security
4939 readers
3 users here now
Confidentiality Integrity Availability
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I work in a HIPAA-covered industry and if our AWS and GCP buckets are insecure that's on us. Fuck Amazon, but a hammer isn't responsible for someone throwing it through a window and a cloud storage bucket isn't responsible for the owner putting secret shit in it and then enabling public access.
What kills me about S3 is that the use cases for publicly accessing S3 contents over HTTP have got to be vanishingly small compared to every other use of the service. I appreciate there's legacy baggage here but I seriously wonder why Amazon hasn't retired public S3 and launched a distinct service or control for this that's harder to screw up.
Wouldn't say so, loads of people and organisations use it as a pseudo-CDN of sorts AFAIK