Hacker News Reader

People here say that this doesn't secure anything. But in addition to encryption by default, AWS announced they will as of April 2023 enforce secure S3 configuration (no public access) by default. So things are definitely getting better when you put these announcements together.

https://aws.amazon.com/blogs/aws/heads-up-amazon-s3-security...

View on HN

Well it’s kind of insane that it has been open by default, resulting in SOOOO many leaks.

They might as well have open SSH access on all EC2 instances using root + “password”

That's not entirely fair - the default has been to ALLOW people to set buckets to public and/or to set public ACLs on individual objects. Both of these require the customer to Do Something in order to grant public access. The default has NOT been "public access for all" ever, that I am aware of.

This definitely dates back to when offloading images and other static assets to S3 from your (era-appropriate) Apache or Varnish server was an optimization of the day...now, obsolete, as, at the time, there were not low-friction, lower-cost CDNs available, such as Cloudfront or Cloudflare.

Cloudfront as the CDN, backed with S3 for your static assets is still a very common pattern on AWS.

It is, but my point is referring to the time when there was no cloudfront.

Reply on news.ycombinator.com