An empty result is not an all clear
An infrastructure audit runs across your account and comes back with two findings on S3. You fix both, close the ticket, and move on. What the report did not tell you is that the role running it lacks s3:GetEncryptionConfiguration . Fourteen buckets returned AccessDenied on that call. The tool caught the rejection, wrote encrypted: false , and moved on to the next bucket. Some of those fourteen…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.
