Object storage: listing, reading, and publication controls

Mechanism

Object storage has separate permissions for listing a container, reading an object, writing it, and changing access policy. Public website configuration, resource policies, ACLs, and account-level blocking controls can interact. Knowing a bucket name or observing a listing does not establish write access or exposure of every object.

Practical method

Identify the provider and exact container or object path. Test a known harmless object and distinguish missing-object errors from permission errors. Inspect policy and public-access controls available in the lab. Compare authenticated and anonymous access to the same object.

aws s3api head-object --bucket lab-bucket --key fixture.txt
aws s3api get-public-access-block --bucket lab-bucket

Interpreting evidence

Record the permission class actually demonstrated. A public object read, a container listing, and a write are independent findings with different impact.

Pitfalls and limits

CDN caches can expose stale objects after policy changes. Presigned URLs grant bounded delegated access and are not evidence of general public access. Object ownership rules affect ACL behavior.