Two curl Commands to Full S3 Access

The Problem

During a routine API penetration test, we inspected the client's frontend JavaScript and found a hardcoded AWS Cognito Identity Pool ID. The Identity Pool had unauthenticated access enabled, meaning anyone on the internet could obtain temporary AWS credentials — no account, login, or API key required.

Two curl commands were all it took: one to get an anonymous identity, one to exchange it for full AWS credentials with read, write, and delete access to the client's S3 storage.

What We Found

The exposed data included uploads, documents, attachments, forms, and media across six buckets — three production, three staging. An attacker could download every file, upload malware, or delete the entire bucket contents.

Further investigation revealed additional S3 buckets with acl = "public-read", allowing direct HTTP directory listing without any credentials at all.

How We Fixed It

The Result

A vulnerability that had been silently exposing confidential client data for over a year was discovered in 20 minutes and the immediate risk was eliminated in 30 minutes. Full remediation — including per-user isolation and path-scoped permissions — was completed within a week.

The client's infrastructure went from "anyone on the internet has full access" to defense-in-depth with least-privilege IAM policies, per-identity isolation, and a roadmap to eliminate browser credentials entirely.

Tools Used