S3 bucket permissions allowing anonymous list

S3 bucket permissions are famously easy to misconfigure. A single toggle can flip a private bucket to allow anonymous LIST operations, which reveals every object key — often including customer names, invoice numbers, backup timestamps, and internal document titles that are never meant to be public. In many cases the objects themselves are also anonymously readable. ## Why attackers exploit it Automated bucket-enumeration tools scan for buckets named with corporate patterns (`-backup`, `-prod`, `-media`) and index every publicly listable one. The resulting object lists are then processed for high-value keys (invoices, contracts, exports, database dumps) and either sold on underground markets or used directly for pretext against the firm. ## Remediation direction Immediate: enable S3 Block Public Access at the account level; audit every bucket for public ACL or bucket-policy grants. Longer term: enforce a mandatory bucket-tagging + review workflow so no new bucket goes production without an explicit privacy-review sign-off.