cyber.hendryadrian.com
Security Insights · wiz.io

Security Risks and Differences in S3-Compatible Cloud Storage

· Original article ↗

Summary

A comparison of S3-compatible storage services finds differences from AWS in public bucket controls, credential handling, least privilege, bucket naming, presigned URLs, encryption, and logging.

Key points

  • S3-compatible providers implement only subsets of AWS S3 features, and some API behavior can differ unexpectedly.
  • Public bucket capabilities vary: some providers do not support them, while others restrict listing or require objects to be made public separately.
  • Credential formats and secret-scanning coverage differ; several providers' keys may be harder for security teams and scanners to identify.
  • Least-privilege controls vary, with some providers offering limited read-only or bucket-specific permissions and others lacking fine-grained access controls.
  • Global bucket namespaces can expose users to bucket-name squatting, potentially directing reads or writes to attacker-controlled buckets.
  • Presigned URLs carry reusable access credentials and can expose objects if logged or otherwise disclosed.
  • Encryption, TLS defaults, and data-plane logging differ across providers, so AWS security assumptions may not apply.

Article Details

Topic
Security characteristics and risks of S3-compatible object storage services, including public buckets, access keys, bucket namesquatting, presigned URLs, encryption, and logging.

Products

AWS S3The way AWS S3 works has become the de facto standard for object storage in many cloud environments outside of AWS.  It can be surprising to use a non-AWS cloud platform and still be asked to use the AWS CLI or anotherCloudflare R2CrusoeSome of the clouds out there with S3 compatible services include Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare, DigitalOcean, and more.  The S3 clones support only a small subset of the features, and some of theseDigitalOceanclouds out there with S3 compatible services include Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare, DigitalOcean, and more.  The S3 clones support only a small subset of the features, and some of these features workGitHubis a common enough problem that there is even a quarantine process that is triggered when this happens on GitHub for AWS keys.  However, these S3 clones do not have a similar process. There are other credentialsLambda LabsSome of the clouds out there with S3 compatible services include Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare, DigitalOcean, and more.  The S3 clones support only a small subset of the features, and some of theseNebiusSome of the clouds out there with S3 compatible services include Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare, DigitalOcean, and more.  The S3 clones support only a small subset of the features, and some of theseVultrSome of the clouds out there with S3 compatible services include Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare, DigitalOcean, and more.  The S3 clones support only a small subset of the features, and some of these

Related Articles