Agent WranglersAPS-63Required
Keep storage buckets private
Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.
How to do it
Turn on the provider's block for public access at account level. Give the app a key that can read and write only its own bucket. Serve private files through signed links that expire within minutes. Serve private files through short-lived links gives the details.
Examples
Shell example
curl -s https://example-shop-uploads.s3.amazonaws.com/ # AccessDenied
curl -s "https://example-shop-uploads.s3.amazonaws.com/?list-type=2" # AccessDeniedHow to check
The agent lists and downloads from each bucket without a key, and guesses common bucket names for the business. Every request is refused.
Sources
Related rules
- INF-59 Block sharing outside the organization in Infrastructure and environments
- INF-29 Keep databases in private subnets in Infrastructure and environments
- MED-20 Sign CDN access to private media for the whole stream in Files and media
- MED-46 Serve private files through short-lived links in Files and media
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/private-storage-buckets">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.