The fix everyone reaches for sits in the wrong place in the sequence. Bucket discovery works through the company's operational DNS, not through a certificate issued to the bucket itself. What leaks is the company's operational DNS. When a certificate is issued for backup.acme.com or cdn.acme.com, that hostname lands in a public certificate transparency log, and certstream streams those issuances in real time [3]. bucket-stream, written by eth0izzle, listens to that stream and turns the observed subdomain fragments into bucket-name guesses like acme-backup, backup-acme, and cdn-acme [3][4]. It sends nothing to your account while it does this [4].
The guesses follow a set pattern. bucket-stream carries a wordlist of the patterns teams actually use, among them company-backup, company-logs, company-data, company-prod, and company-staging, which means the names that read as sensible internally are the first ones an outsider tests [5]. The `--skip-lets-encrypt` flag exists to drop personal-project certificates and keep the queue pointed at real infrastructure [5].
From there the pipeline runs on public indexes before any active scan. GrayhatWarfare indexes 318,000 buckets and 4 billion files as of 2022, searchable with no authentication and filterable by extension down to .env, .sql, .key, .pem, and .bak [6]. snallybuckster automates those searches and pulls the matching files [7]. Only once a name looks live does the active phase start: S3Scanner tests permissions against a name list with no AWS credentials, and AWSBucketDump walks the files for keys and configs [8].
Now place Block Public Access on that timeline. It is a permission-time control that answers the request S3Scanner sends, and certstream sits outside its reach because the discovery already ran before any permission check [2]. The map exists whether or not the door is locked.
The reconnaissance is quiet by construction: a permission scan across 20 names produces minimal logging, and the CT-log discovery phase produces none, so the step with the most value is the one with no trace to hunt [1][10]. A hit in GrayhatWarfare reflects a past state, not a current one. It proves the bucket was readable at some point, possibly for hours or days, and the file may have been copied before anyone clicked the fix [9]. Today's permission check only speaks to today, not to what already left.
None of this is AWS-specific. In GCS, an allUsers binding with roles/storage.objectViewer makes a bucket anonymously listable over HTTP, and GCPBucketBrute enumerates it the same nameless way [11]. Azure Blob offers three access levels, Private, Blob, and Container, where Container means full anonymous listing and read [12]. The source notes most pentesters test only AWS, which leaves the other two less examined [11].
