AWS S3 Bucket Security: Find the Secrets Hiding Outside Git

AWS S3 Bucket Security: Uncovering Secrets Beyond Git

In recent years, Amazon S3 buckets have emerged as a hidden vulnerability for organizations, acting as a repository for years' worth of logs, backups, and pipeline output. Often, this data goes unchecked for secrets, leaving a significant security blind spot. According to a 2025 incident reported by Sysdig, attackers were able to gain administrative access within eight minutes using IAM keys discovered in a public bucket.

The primary issue lies in the sheer volume of data stored in S3 buckets, which primarily comprises logs, backups, and pipeline output. This data seldom undergoes secret scanning, making it challenging to identify exposed credentials. As organizations transition to more cloud-native setups, an increasing amount of operational data, CI/CD artifacts, logs, and infrastructure files are stored in S3 buckets.

In the past, secret scanning focused primarily on source code repositories, where developers commonly commit API keys, passwords, and tokens. However, as applications generate more data and organizations expand their cloud footprint, the need for comprehensive credential visibility beyond source code has become crucial.

AWS recommends a layered security approach for S3 buckets, which includes blocking unintended public access, enforcing least-privilege IAM permissions, disabling ACLs, encrypting data at rest, requiring encrypted connections, enabling logging, and continuously auditing bucket configurations. Services such as GuardDuty and Macie provide monitoring for suspicious activity and sensitive data exposure.

However, secret scanning goes a step further by identifying credentials within the objects themselves, addressing another layer of security.

Recently, GitGuardian has started scanning AWS S3 buckets for exposed secrets, including ZIP and tar.gz archives, and has integrated the findings into existing incident workflows. This new coverage is essential for organizations striving for complete credential visibility. While securing the infrastructure surrounding the bucket is essential, identifying and remediating exposed secrets in overlooked corners of the environment is equally vital.

The GitGuardian State of Secrets Sprawl 2026 revealed that 28% of secret incidents originate entirely outside source code repositories and are 13% more likely to be critical than code-only incidents. As AI-assisted tools become more prevalent, the speed and ease of discovering credentials and paths to additional access are accelerating, posing a significant threat to cloud environments.