Show HN: S3 Bucket Monitoring – Are your private buckets private?
Shane and August here from Cronitor. We built this S3 monitoring feature and are excited to be launching it on HN today and hearing your feedback.
A little backstory - a couple of months ago I was talking to a friend who works at a ~500 person company. They have a small development/IT team, but software development isn't their core business.
In his second month on the job my friend was combing through S3 buckets to get a sense of what teams were using it. In doing so he came across a public bucket that contained both private customer and business data. It seemed clear to him that this bucket definitely should be private so he started asking around.
It turned out an analyst in the finance department had asked someone they knew on the development team if they could make that bucket public so that they could pull data from it programatically. That person, not knowing any better, and wanting to help a more senior person at the company made the change and went on with their day.
There have been so many examples of S3 buckets exposing private data[0], and this conversation made me realize that this was a perfect addition to our uptime monitoring service[1]. We use AWS lambdas that attempt to connect to your bucket in a couple of different ways to determine if there is any public access. It’s built on top of our existing Uptime Monitoring network by using Boto for these checks instead of our standard HTTP client. We check your buckets constantly and if a private bucket suddenly becomes public an immediate alert is sent to the right person.
Let us know what you think!
https://cronitor.io/s3-monitoring
[0] https://businessinsights.bitdefender.com/worst-amazon-breaches
[1] https://cronitor.io/uptime-monitoring