---
title: "Keep storage buckets private · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep storage buckets private

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.
- How: Turn on the provider's block for public access at account level. Give the app a key that can read and write only its own bucket. Serve private files through signed links that expire within minutes.
- Check: The agent lists and downloads from each bucket without a key, and guesses common bucket names for the business. Every request is refused.

Example:

```sh
curl -s https://example-shop-uploads.s3.amazonaws.com/                 # AccessDenied
curl -s "https://example-shop-uploads.s3.amazonaws.com/?list-type=2"   # AccessDenied
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets`.

- Previous: [Give each key the least power](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys)
- Next: [Keep card numbers off your servers](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/hosted-payment-fields)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)