The 15-Minute S3 Audit (Because the Average Misconfiguration Sits for 180+ Days)

Cloud security reporting this year keeps landing on the same uncomfortable number: misconfigured storage sits unnoticed for months, often 180 days or more, before anyone catches it — usually a security review, a compliance audit, or worse, an incident. S3 is the most common repeat offender, not because it's poorly designed, but because a bucket created correctly two years ago rarely gets a second look once it's working.

The checklist

• Block Public Access — check it's enabled at the account level, not just per-bucket. Account-level is the setting that actually protects you against a future bucket created without thinking about it.
• Bucket policies — grep for "Principal": "*" across every bucket policy. That's a public grant, full stop, regardless of what Block Public Access says elsewhere.
• Default encryption — every bucket should have SSE enabled by default. If a bucket predates your org's standard, it was probably created before that standard existed.
• Access logging — is it turned on for buckets holding anything sensitive? If a bucket is ever involved in an incident, logging is the difference between an investigation and a guess.
• Versioning + MFA delete on anything holding data you can't afford to lose to a compromised credential or a fat-fingered delete.
• Bucket ownership — for buckets that predate 2023, confirm they're using Bucket Owner Enforced (ACLs disabled). Older buckets are the ones most likely to still be running the pre-2023 ACL model.

Why this specific list, and why 15 minutes

This isn't the full S3 section of a Well-Architected review — it's the subset that's fast enough to run yourself, this week, without provisioning any new tooling. Six checks, one per bullet above, against every bucket in the account. If that turns something up, it's worth escalating; if it doesn't, you've closed the most common gap for another quarter.

The 180-day number isn't a scare tactic — it's the actual reported average, and it's long enough that a bucket misconfigured today is more likely than not to still be misconfigured at your next annual review if nobody looks in between. A quarterly 15-minute pass is cheap insurance against being the account that becomes a statistic.