Incident

Public object-storage bucket exposed — customer files world-readable

Cloud InfrastructureDifficulty · Easy

Retry in progress

You have 1 previous attempt for this scenario. Submitting again will create a new attempt and show a comparison against your most recent response.

Public Object-Storage ExposureDifficulty · easyHigh asset

[CSPM ALERT] Storage bucket 'acme-customer-docs' is publicly readable

From: Cloud Posture Monitoring <cspm-alerts@acme-corp.io>
To: cloudsec@acme-corp.com
Date: 2026-05-04 08:42 UTC

Automated cloud posture alert. The object-storage bucket 'acme-customer-docs' (region us-east-1) was flagged with a public-read access policy. The bucket holds customer onboarding documents (PDFs, scanned IDs). The change that opened it appears in the bucket policy history ~14 hours ago. This is a vendor-neutral way of saying: a storage container that should be private (think AWS S3 / Azure Blob / GCS) is currently readable by anyone on the internet. Please triage. We need to know: is it actually public, what is in it, who may have read it, and how do we close it without destroying the evidence we'll need. — Cloud Posture Monitoring

Evidence

Bucket policy + access-log excerpt

# Current bucket access (read-only view from CSPM)
Bucket: acme-customer-docs
Effective access: PUBLIC-READ (principal "*", action getObject/listObjects)
Default new-object ACL: inherits bucket policy (public)
Object count: ~4,300 documents
Encryption at rest: enabled (provider-managed key)

# Bucket policy change history (last 24h)
2026-05-03 18:55 UTC  policy updated by user 'svc-onboarding-deploy'
                       statement added: Allow "*" getObject,listObjects
                       (previous policy: private, owner-account only)

# Access-log sample (last 14h, anonymized source IPs)
2026-05-03 19:02  GET listObjects   200   src=ASN-not-in-allowlist (cloud range)
2026-05-03 19:03  GET getObject /onboarding/id-scan-1182.pdf  200  4 requests
2026-05-04 02:10  GET listObjects   200   src=multiple external ranges
                  -- reads are from outside the corporate / known-partner ranges

# Controlled distractors (rule out wider faults)
Other 11 buckets in the account: all still private (CSPM scan clean)
No IAM user/role was deleted; no encryption key was disabled.

Affected asset

Name: acme-customer-docs (object-storage bucket)
Type: Cloud object storage holding customer onboarding documents (PII); currently public-read; encrypted at rest; ~4,300 objects
Owner: Cloud Security · Data Platform
Level: High