Hacker News Reader

> and the bucket itself had no protection against outside access with a compromised key

Any advice on how to safeguard against this?

Don't use static keys, and audit access to sensitive resources.

If possible, use VPC endpoints and lock down the bucket to only allow access from them.