S3 Compatibility Doesn't Guarantee S3-Level Security

Security researchers at Wiz recently analyzed S3-compatible object storage services offered by six prominent neocloud providers, uncovering substantial security vulnerabilities compared to Amazon S3. The investigation assessed the offerings from Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean against those of AWS.

Scott Piper, principal cloud security researcher at Wiz, emphasizes that organizations utilizing S3 clones cannot rely on the same level of security as with AWS, as they must contend with reduced protections and limited least-privilege capabilities.

Piper warns that the nearly 300 S3 APIs, accumulated over the service's 20-year history and supporting vast amounts of data, create a false sense of portability. However, not all functionality has been replicated among the S3 clones, which vary significantly in their handling of public buckets. While Crusoe and Lambda Labs lack public-access features, others offer fewer protections and controls than AWS S3's Block Public Access.

Nebius and Cloudflare R2 permit public buckets but block anonymous object listing, whereas DigitalOcean allows publicly accessible buckets and Vultr supports both ACLs and bucket policies for public access.

When it comes to access keys, S3-compatible services often lack the structured formats and secret-scanning capabilities available for AWS credentials, making them harder for security teams and tools like GitHub to detect. Additionally, the differing IAM capabilities and semantics among S3-compatible implementations have led to multiple reported vulnerabilities, including unauthorized privilege escalation and broken tenant isolation.

Corey Quinn, chief cloud economist at The Duckbill Group, notes that all neoclouds provide S3-compatible endpoints, leading users to adopt the same muscle memory that they used with AWS, regardless of whether the APIs function as intended.

Wiz's investigation revealed that one S3 clone, `delete-bucket-policy`, removed the entire bucket, highlighting the importance of auditing API behavior, verifying permission models, and validating how standard AWS tooling interacts with these endpoints. To ensure proper security, organizations leveraging S3-compatible storage in neoclouds should explicitly review API behavior, check permission settings, and validate the interactions between standard AWS tooling and these endpoints.

Wiz's review does not cover several other major S3-compatible implementations, with the S3-compatible storage providers directory listing over 90 providers and Awesome Object Storage comparing 21 providers across various hyperscalers, alternatives, edge/CDN-native, self-hosted, and decentralized options.