---
title: "Keep storage buckets private · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/secrets-and-configuration/private-storage-buckets
id: APS-63
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 867
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep storage buckets private

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-63
- Level: Required
- Chapter: [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)
- Rule: Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.
- Check: The agent lists and downloads from each bucket without a key, and guesses common bucket names for the business. Every request is refused.
- Risk: Data leaked or lost
- How: Turn on the provider's block for public access at account level. Give the app a key that can read and write only its own bucket. Serve private files through signed links that expire within minutes. [Serve private files through short-lived links](https://agentwranglers.se/playbook/files-and-media/serving-files/signed-downloads.md) gives the details.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
curl -s https://example-shop-uploads.s3.amazonaws.com/                 # AccessDenied
curl -s "https://example-shop-uploads.s3.amazonaws.com/?list-type=2"   # AccessDenied
```

## Sources

- [OWASP WSTG on testing cloud storage](https://wstg.owasp.org/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management/11-Cloud_Storage/)
- [Amazon S3 documentation on blocking public access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)

## Related rules

- INF-59 [Block sharing outside the organization](https://agentwranglers.se/playbook/infrastructure/identity-and-access/block-external-sharing.md) in Infrastructure and environments
- INF-29 [Keep databases in private subnets](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores.md) in Infrastructure and environments
- MED-20 [Sign CDN access to private media for the whole stream](https://agentwranglers.se/playbook/files-and-media/serving-files/signed-cdn-access.md) in Files and media
- MED-46 [Serve private files through short-lived links](https://agentwranglers.se/playbook/files-and-media/serving-files/signed-downloads.md) in Files and media

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/private-storage-buckets">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give each key the least power](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/least-privilege-keys.md)
- Next: [Close debug and admin doors](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors.md)
- [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)