I Ran a Real AWS Scan This Week. Here’s What It Found in 60 Seconds.

I connected a test AWS account to KloudSec this week and let it run a full S3 scan. Two findings stood out, not because they're exotic or rare, but because I see them constantly, in real accounts, at real companies. Here's exactly what the scan caught, and exactly how each one gets fixed.

Finding one: the bucket was public

Watch it happen: https://youtu.be/437u-QjxHHk?si=F5_MZBUrm9SlaGLu

The scan flagged a bucket where Block Public Access was turned off. That setting is actually four separate flags: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets. When they're disabled, the bucket is either already public or one bucket policy change away from it, and there's no warning bell when that happens.

One command closes it:

aws s3api put-public-access-block \
  --bucket your-bucket \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

aws s3api put-public-access-block \
  --bucket your-bucket \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Finding two: the bucket couldn't undo a mistake

Watch it happen: https://youtu.be/gmKY5FaoCaQ?si=sfZUZ1WXMkv08LLe

The second flag was quieter but just as real: versioning was disabled. No versioning means no safety net. A bad script, a wrong **_— recursive_** flag, a bug that overwrites the wrong key, and whatever was in that object is simply gone. Not recoverable, not in a trash folder, gone.

One command fixes it:

aws s3api put-bucket-versioning \
  --bucket your-bucket \
  --versioning-configuration Status=Enabled

aws s3api put-bucket-versioning \
  --bucket your-bucket \
  --versioning-configuration Status=Enabled

Why I'm sharing two boring findings

Neither of these is a novel attack technique. That's exactly the point. Most real incidents aren't sophisticated, they're a setting nobody flipped, sitting quietly until the day it matters. Both findings above were rated high severity and mapped straight to CIS, PCI DSS, ISO 27001, GDPR, and HIPAA, frameworks that exist precisely because of failures this ordinary.

The scan took under a minute. Each fix took one command. That gap, between how small the fix is and how large the consequence would have been, is the entire reason I built KloudSec: so this kind of thing gets caught automatically, instead of found the hard way.

Try it free: kloudsec.io