S3 will automatically block public access and disable ACL for new buckets | Hacker News Reader

S3 will automatically block public access and disable ACL for new buckets

aws.amazon.com

57 pointsbubblehack3r9 comments

With the amount of information leaks that have occurred from S3 buckets being public, I'm surprised this wasn't fixed a decade ago.

Both were made default at their inception, at least on the console.

You need to remember the S3 API is from 2006 and Amazon probably measure how many buckets are created with these 17 year old defaults and then actually stay and rely on these defaults.

Public access by default was a boneheaded decision from the very beginning. Even in 2006 it was already well-known for decades how public anonymous access to things could lead to problems. All they needed to do was provide a checkbox to enable public access.

I've never worked at AWS, but I have worked on smaller systems where people depended on defaults. Speaking first hand, it is EXTREMELY difficult to get changes to defaults shipped on a system with as much usage as S3.

You are, inevitably, going to break someone's workflow for a reason that you cannot possibly fathom. They are going to be unhappy. At least one of them is going to come across your boss' boss' desk and they're going to wonder if this change is _really_ necessary.

Every incentive, even with this default behavior being bad, is to leave it the way it is.

Respect to the AWS people that got this across the line.

People who say this should have been done earlier, what is the use case where you considered this a problem? This was already the console UI default for manually created new buckets. Was it a problem with using CloudFormation or APIs to create buckets?

Perhaps you're familiar with the saying: "Make something idiot-proof and someone will make a better idiot."

Don't get me wrong; these are good settings and I applaud AWS for making them. They certainly will reduce the chances of people accidentally making a bucket public. I'm just sad because I know there are those intentionally making a bucket public when they shouldn't.

Sometimes it's just easier to chmod 777 and watch all your access problems disappear.

We wrote a post on this and some of the nuances/discrepancies for these S3 settings: https://www.cloudquery.io/blog/finding-enabled-s3-acls-and-d...

Better late than never.

At long last

Reply on news.ycombinator.com