S3

Public buckets — "block public access is on" does not mean the hole is gone

Bucket leaks come from configuration, not attack. The line that matters in the docs: block public access settings do not alter existing policies or ACLs — the block covers the hole, it does not close it, and removing it restores public access. So the goal is not "blocking is enabled" but "nothing is public even with blocking off". Apply it at the account level, because a bucket policy can grant someone the ability to turn a bucket-level block off. And "public" is defined more broadly than people assume.