Amazon will now allow AWS account owners to set the default access setting for all of their account's S3 buckets as non-public to prevent accidental data leaks
New settings will prevent accidental S3 bucket leaks —if customers take the time to apply them.
Context & Ripple Effects
This setting is another step in AWS's long conversion of S3 security from customer opt-in to platform default. In 2017 it shipped default encryption and warnings about unencrypted files; in 2023 it went further with automatic server-side AES-256 encryption for every new object. Account-level non-public access extends the same logic from data-at-rest to permissions.
The urgency comes from a decade of misconfiguration leaks on AWS itself — most visibly the hundreds of exposed EBS snapshots a researcher found leaking VPN configs, passwords, and government data. Per-bucket settings clearly weren't enough; the fix has to operate at the level where mistakes are made.
First-order effects
- AWS account owners managing large bucket fleets get a single switch that makes non-public the inherited default, eliminating the per-bucket configuration drift that produced past accidental exposures.
- Customers who don't apply the setting gain nothing — ZDNet's own framing notes the protection only works if administrators take the time to turn it on.
Second-order effects
- Rival cloud providers face pressure to match account-level deny-by-default controls, since 'our buckets were public by accident' is now an avoidable headline rather than an accepted risk.
- Security auditors and compliance reviewers can raise their baseline: with a provider-supplied default available, leaving buckets publicly accessible becomes a documented customer choice rather than a neutral configuration.
Third-order effects
- The pattern points toward eroding the customer-side burden in cloud shared-responsibility models, with providers absorbing misconfiguration risk through defaults — a structural shift in who is accountable when data leaks.
- As AWS expands what touches S3 — including new surfaces like Amazon S3 Files letting applications and AI agents read buckets as local file systems — access defaults stop being hygiene and become the load-bearing boundary for machine consumers of stored data.
The trend: Cloud providers are steadily converting security controls from customer opt-in settings into platform-enforced defaults, with S3's decade-long march from optional encryption to account-level private-by-default access as the clearest running example.