Cloud storage makes it easy to share files, which also makes an accidental public setting important. A file can be encrypted on the provider’s disks and still be available to anyone who asks for it. Encryption and access permission solve different problems. Review both.
Understand the idea
A person may reach a file through a user account, a public storage policy, a shared link, or a website that delivers the file. Making one of these routes private does not automatically close the others. Start by identifying the files, their intended audience, and every route that can deliver them.
- Locate
Identify the storage location and the information inside it.
- Restrict
Close unnecessary public and shared access paths.
- Verify
Retest access and investigate evidence of prior downloads.
A practical example
For example, an NGO stores a private backup beside public website images. The files use the same storage service, but they need different audiences. The team separates the backup, removes unnecessary sharing routes, and checks whether access records show downloads while it was public.
What to do next
- Inventory stores and owners. Include old accounts, test environments, static-site storage, snapshots, and copies created by vendors.
- Inspect effective policy. Review identity permissions, resource policies, legacy access lists, cross-account trust, and any public-access exception. On Amazon S3, evaluate Block Public Access settings at the relevant scopes.
- Classify the contents. Record whether the location holds public assets, customer information, passwords and access keys, or backups. Avoid copying sensitive files into a separate review spreadsheet.
- Verify from an unprivileged context. Use an approved synthetic object and a clean unauthenticated client to test the intended policy. Also test a known unauthorized identity; anonymous denial alone does not prove correct cross-account access.
- Log important data access. Management audit logs and object-read logs may require different settings and have different costs. Confirm which questions your logs can answer.
How to check the result
Test the corrected setting from an account that should not have access. Keep the result and check that the people who genuinely need the files can still work.
The files are encrypted at rest. Can they still be public?
Yes. Storage encryption does not prevent the service from delivering decrypted files to an allowed requester. Review access policy separately from encryption.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
