Public S3 Bucket Scanner and Cloud Storage Exposure Checker
This free public S3 bucket scanner checks whether an Amazon S3, Google Cloud Storage or Azure Blob container allows anonymous listing. Enter a container address, or a website address to test the storage its pages reference, confirm you may check it, and read the result in one place. The check runs from outside, takes at most four minutes and never downloads object contents.
- Free
- No account needed
- S3, GCS and Azure Blob
- Up to 4 minutes
How to check if an S3 bucket is public
- 1Enter the addressType a storage container address or a website address. Public targets only.
- 2Confirm permissionTick the box to confirm you own the target or have permission to check it.
- 3Read the resultSee whether anonymous listing is possible and what could not be checked.
What the cloud storage exposure checker reports
The result tells you whether anonymous listing is possible for each container it tested, and it notes anything it could not check. Unchecked areas are never treated as clean. The check tests listing access only, and object contents are never downloaded.
- Provider: Amazon S3, Google Cloud Storage and Azure Blob containers are supported.
- Listing: whether the object names can be read without credentials.
- Limits: what the check could not test, so you know what still needs a manual review.
Why public cloud storage is a risk
When a container allows anonymous listing, anyone can read the names of the objects inside it, which often reveals backups, exports and internal files. Objects can also be readable on their own, depending on their permissions. Public containers are among the most common cloud misconfigurations, and they are easy to find because they can be tested from the outside.
How to fix a public storage container
Amazon S3
Turn on S3 Block Public Access for the bucket and the account, then review the bucket policy and ACLs for public grants.
Google Cloud Storage
Remove allUsers and allAuthenticatedUsers from the bucket permissions and enforce public access prevention.
Azure Blob Storage
Set the container access level to private and disable anonymous blob access on the storage account.
Recheck after every change, from outside your own network.
What this check does not cover
It checks only the containers you supply or that a website page references. It does not review cloud account configuration, identity permissions, encryption or logging, and it cannot reach private containers. A container that cannot be listed can still hold objects that are readable by direct link. For the externally visible rest of your cloud, see the cloud vulnerability scanner, and read about common cloud misconfigurations and the cloud security audit checklist.
What a free account adds
Create a free account to protect one website, with a dashboard for your checks and reports. The Free plan includes one website security scan, plus basic malware and uptime monitoring, with the TLS certificate and domain expiry checked daily. Compare paid plans on the pricing page.
Frequently asked questions
What is a public S3 bucket scanner?
A public S3 bucket scanner checks whether a storage container can be listed by anyone on the internet without credentials. This free tool tests Amazon S3, Google Cloud Storage and Azure Blob containers for anonymous listing and never downloads object contents.How do I check if an S3 bucket is public?
Enter the bucket address, or a website address to test the storage its pages reference, in the checker above and confirm permission. The result tells you whether anonymous listing is possible. You can also review the bucket policy, ACLs and Block Public Access settings in your AWS console.Does the check download my files?
No. The check tests whether anonymous listing is possible. Object contents are never downloaded.What does anonymous listing mean?
Anonymous listing means anyone on the internet can read the names of the objects in a container without credentials. Objects can also be readable separately, which depends on their own permissions.Which cloud providers are supported?
Amazon S3, Google Cloud Storage and Azure Blob containers are supported.Do I need an AWS, Azure or Google Cloud account?
No. The check runs from outside and needs no cloud account and no ScanTitan account. You only confirm that you own the target or have permission to check it.Can I check a bucket that I do not own?
No. The tool is for public targets that you own or are allowed to check, and it does not accept passwords, private addresses or network ranges.Storage is one part of your cloud exposure. Check the websites and servers behind it as well.
Cloud vulnerability scannerSee pricing