Agent Wranglers

Data and secrets Required

Keep storage buckets private

Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Turn on the provider's block for public access at account level. Give the app a key that can read and write only its own bucket. Serve private files through signed links that expire within minutes.

Example

curl -s https://example-shop-uploads.s3.amazonaws.com/                 # AccessDenied
curl -s "https://example-shop-uploads.s3.amazonaws.com/?list-type=2"   # AccessDenied

How to check

The agent lists and downloads from each bucket without a key, and guesses common bucket names for the business. Every request is refused.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets.