One statement that made a bucket public
Read an S3 bucket policy with the AWS CLI and jq. Find the statement that allows anyone to read objects, the prefix it exposes, and the account settings that failed to stop it.
Briefing
A customer found a link to a file in nw-shop-exports that opened without signing in. You have read-only AWS CLI access in the account.
get-bucket-policy returns the policy as a JSON string inside JSON, so pipe it through jq -r .Policy and then jq again. A Principal of "*" with Effect Allow means anyone on the internet, unless Block Public Access stops it.
cloud-shell · Cloud CLI review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.