s3-estate-calibration-auditor

To check if an S3 bucket is truly publicly exposed, you must compose Block Public Access settings, bucket policies, ACLs, and access points. A Principal '*' policy is often neutralized by Block Public Access or scoped by conditions, meaning the bucket is not genuinely live exposure.

The best way to audit a multi-bucket S3 estate for false positives is to calibrate effective exposure by resolving Block Public Access, bucket policy, ACL, and access point layers together. This distinguishes genuinely live public exposure from neutralized lookalikes.

Block Public Access does not neutralize cross-account grants on S3 buckets. While it blocks public grants like AllUsers ACLs, cross-account grants survive Block Public Access neutralization, requiring symmetric discipline to identify them as separate live exposure risks.

You can audit S3 bucket security offline without live AWS credentials by using offline JSON config files from describe-bucket, get-bucket-policy, get-bucket-acl, and list-access-points API calls. The audit resolves the true effective exposure verdict from these static configuration files.

An S3 bucket shows public access but remains secure because the Principal '*' in the policy is narrowed by condition scoping, such as org ID, ExternalId, SourceIp, or access-point delegation. Condition-scoped policies are not treated as genuinely public exposure.

To identify the one genuinely exposed S3 bucket among neutralized siblings, apply effective exposure resolution across the entire estate. This needle detection process isolates buckets with live public policies, cross-account grants, or public ACLs from those blocked by BPA.