Cloud Storage Security: Avoiding the Billion-Dollar Leak

The Billion-Dollar Mistake

In 2017, a misconfigured AWS S3 bucket exposed 198 million US voter records. In 2021, a similar misconfiguration leaked 100GB of Microsoft's customer data. These weren't sophisticated attacks — anyone with a web browser could have accessed the data.

How Storage Buckets Get Exposed

Most cloud storage leaks follow the same pattern:

1. A developer creates a bucket for public assets (images, CSS, JS)
2. They set the bucket to "public" to make it work
3. Over time, sensitive files end up in the same bucket
4. No one remembers to tighten permissions

Platform-Specific Guidance

AWS S3

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-app-data/*",
      "Condition": {
        "StringNotEquals": {
          "aws:SourceVpce": "vpce-12345678"
        }
      }
    }
  ]
}

Use bucket policies rather than ACLs, and always use the BlockPublicAccess setting.

Cloudflare R2

R2 is S3-compatible. Use the same IAM-style policies, and enable presigned URLs for temporary access instead of making buckets public.

Supabase Storage

Supabase Storage uses RLS policies, similar to their database:

-- Only allow users to access their own files
CREATE POLICY "Users can access their own files"
ON storage.objects FOR ALL
USING (auth.uid() = owner_id);

Firebase Storage

Firebase Storage uses security rules:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth != null
        && request.auth.uid == userId;
    }
  }
}

Sentinel's Cloud Storage Checks

Our scan engine looks for:

• Publicly accessible S3/R2 bucket listings
• Supabase storage without RLS
• Firebase storage with open allow read, write rules
• Hardcoded storage URLs in client-side JavaScript bundles

Summary

Cloud storage is not automatically secure. Default configurations often prioritize accessibility over security. Check your bucket policies, use presigned URLs, and scan regularly for exposed storage. Sentinel's free scan checks for common cloud storage misconfigurations.