In s3 you not only have to mark the bucket as public, but also toggle a safety switch allowing the bucket to be made public, and you have to write an ACL policy allowing public access, and you will get a monthly email from AWS reminding you that this bucket is setup for public access. Oh, and the bucket has the word "public" next to it.

Like, what more can AWS do? Require a blood sacrifice? Call your boss?