I guess that prevent-public-bucket feature they released last week can come in handy.