How to Perform a Security Review of Your Cloud Storage Buckets
Cloud storage buckets make it easy to hold documents, backups, application data and customer records at scale. They also create a concentrated security risk when permissions, encryption settings or public access controls are misunderstood. A sound review examines the bucket itself, the identities that can reach it and the systems that send data in or out.
For Australian organisations, the review should reflect the Privacy Act, the Notifiable Data Breaches scheme and industry expectations such as the Essential Eight. A business operating workloads in Sydney or Melbourne cloud regions may still expose data through an overseas backup, a misconfigured SaaS integration or a contractor’s compromised account.
Define The Review Scope
Start by building an inventory of every storage bucket across AWS, Microsoft Azure, Google Cloud and connected platforms. Record the account, subscription or project, region, owner, business purpose, data type and retention requirement. Include dormant environments, development accounts and buckets created by infrastructure-as-code pipelines.
Classify the contents before testing access. Customer identities, payment details, health information, legal files and intellectual property require stronger controls than public product images. In Australia, data residency expectations may be especially important for government suppliers, financial institutions and healthcare providers, even where a specific law does not mandate local hosting.
Check Public Exposure And Access Policies
Review bucket-level settings, object-level permissions, access control lists, resource policies and cloud organisation guardrails. Test whether an unauthenticated user can list, read, write or delete objects. A bucket may appear private while an individual object, temporary URL or cross-account policy remains openly accessible.
Search for wildcard principals, broad actions such as GetObject or PutObject, and permissions granted to entire cloud accounts. Confirm that administrative access is separate from application access. A web application should usually receive only the permissions it needs, rather than full control over an entire storage service.
Examine Identity And Privileged Access
Map every human and machine identity with bucket permissions, including developers, service accounts, CI/CD runners, backup tools and third-party integrations. Remove inactive users, expired contractors and unused roles. Require phishing-resistant multifactor authentication for privileged administrators and apply just-in-time access where the platform supports it.
Check whether credentials are stored in source code, configuration files, container images or spreadsheets. Rotate exposed keys and replace long-lived access tokens with workload identities or short-lived credentials. A managed security provider such as Infoziant Security can help correlate cloud permissions with broader identity and threat monitoring controls.
Validate Encryption And Key Management
Confirm that data is encrypted in transit and at rest using the cloud provider’s approved mechanisms. Review whether sensitive buckets use customer-managed keys, how those keys are rotated and which administrators can decrypt data. Encryption has limited value if the same overly broad role can access both the bucket and its key.
Inspect backup copies, replicas, snapshots and exported archives as well. They often inherit weaker settings than the production bucket. Verify that encryption failures cause uploads to be rejected, rather than allowing unprotected objects into a sensitive location.
Review Logging, Monitoring And Response
Enable data access logging, administrative activity records and object-level events where the risk justifies the cost. Send logs to a separate, protected account so an attacker cannot erase evidence after gaining access. Set alerts for public policy changes, unusual downloads, mass deletions, key access and activity from unexpected locations.
Australian teams should align alert handling with their incident response plan and Notifiable Data Breaches obligations. An alert at 2 am in Perth may need a clear escalation path to an on-call analyst in Sydney or Melbourne, with documented decisions about containment, notification and evidence preservation.
Apply Retention And Data Governance Controls
Review lifecycle rules for ageing objects, version histories, deleted files and legal holds. Excessive retention increases the volume of data that could be exposed, while premature deletion can breach contractual or regulatory requirements. Make retention schedules understandable to application owners rather than leaving them as undocumented cloud defaults.
Look for sensitive data in unsuitable locations, including test buckets and developer sandboxes. Use approved discovery or classification tools to identify personal information, secrets and regulated records. For organisations handling My Health Record-related information or financial data, connect cloud storage rules to the relevant sector controls and contractual obligations.
Use A Repeatable Review Checklist
A documented checklist makes the assessment consistent across accounts and gives owners a practical remediation record. Capture the evidence, affected resource, business impact, recommended fix, responsible person and due date for each finding.
Run the review after major migrations, acquisitions, new application launches and changes to identity architecture. For a deeper assessment, combine configuration review with vulnerability testing, attack-path analysis and a controlled penetration test.
- Inventory buckets, regions, owners and data classifications
- Test anonymous, cross-account and application access
- Check encryption, key permissions and backup protection
- Review identities, tokens, roles and multifactor authentication
- Confirm logging, alerting and incident escalation
- Record remediation owners and verification dates
Recognise High-Risk Findings Quickly
Some findings demand immediate containment, especially when customer or employee data is involved. Preserve logs before changing settings, restrict exposure, rotate credentials and assess whether unauthorised access occurred. Avoid deleting the resource before collecting useful forensic evidence.
Treat a clean automated scan as a starting point rather than proof of security. Effective assurance also considers business logic, cloud federation, inherited permissions and paths through connected services. A manual review can reveal that a seemingly private bucket is accessible through a compromised deployment role.
- Public read or write access on a sensitive bucket
- Wildcard permissions for users, roles or external accounts
- Secrets or cloud keys committed to repositories
- Missing access logs for regulated or high-value data
- Unencrypted replicas, exports or backup archives
- No tested process for mass deletion or data exposure
A well-run cloud storage review turns configuration details into clear risk decisions. Arrange an independent assessment, validate the highest-priority fixes and schedule recurring checks so your buckets remain secure as applications, staff and cloud environments change.
