FactorAI
Demo ModeExit demoStart free
Ready
You
Check our S3 buckets for public access or missing encryption.
Assistant

Your S3 exposure check is done. Of 46 buckets, 2 need attention:

BucketIssueAction
acme-marketing-assetsPublic read on /drafts/Remove the ACL
acme-support-exportsNo default encryptionEnable SSE-KMS

I opened SEC-451 for both.

You
What is actually exposed in acme-marketing-assets?
Assistant

The public ACL is on 11 objects under /drafts/, all uploaded by the marketing agency's service role. None are customer data, but two are unreleased campaign decks.

You
Did anyone outside access them?
Assistant

Neither bucket has been accessed from outside our accounts in the last 30 days.

  • acme-marketing-assets: 0 anonymous GETs on /drafts/.
  • acme-support-exports: only the export job role reads it.
You
What is the fix plan?
Assistant

Fix plan for SEC-451: remove the ACL, set bucket policy to block public access, and enable SSE-KMS with the shared support key. Existing objects get re-encrypted in place. Want me to apply it?

You
Do it.
Assistant

Applied to both buckets.

  • Public access block enabled on acme-marketing-assets.
  • Default SSE-KMS set on acme-support-exports; re-encryption of 8,412 objects is running.

I will mark SEC-451 done once the copy finishes.