Score an S3 bucket's public exposure across Block Public Access, bucket policy, object ACLs, website endpoints, pre-signed URLs and encryption.
Every real path to a public object is scored with the points it contributes: Block Public Access is the strongest single control, so it carries 30 points, while the bucket policy carries 25 and object ACLs 15. Pre-signed URL lifetime scales logarithmically because the difference between fifteen minutes and one hour matters far more than the difference between a week and a month — both are already indefinite in attacker terms. Public buckets remain the most common cause of large cloud data leaks, and the reason is almost never a single setting: it is a bucket policy that survived a Block Public Access rollout, or a pre-signed URL with a seven-day lifetime pasted into a ticket.
S3 Bucket Exposure
Exposure index = Block Public Access points + bucket policy points + ACL points + website points + encryption points + min(12, log2(pre-signed URL hours) × 1.4), clamped to 0–100.
Sensitivity weighting
Sensitivity-weighted risk = exposure index × (0.55 + classification × 0.1125), so regulated data carries the full index and public content carries about two thirds of it.
Exposure index = Block Public Access points + bucket policy points + ACL points + website points + encryption points + min(12, log2(pre-signed URL hours) × 1.4), clamped to 0–100. Every real path to a public object is scored with the points it contributes: Block Public Access is the strongest single control, so it carries 30 points, while the bucket policy carries 25 and object ACLs 15. Pre-signed URL lifetime scales logarithmically because the difference between fifteen minutes and one hour matters far more than the difference between a week and a month — both are already indefinite in attacker terms.
Public buckets remain the most common cause of large cloud data leaks, and the reason is almost never a single setting: it is a bucket policy that survived a Block Public Access rollout, or a pre-signed URL with a seven-day lifetime pasted into a ticket.
This calculator takes 9 inputs: Block Public Access settings, Bucket policy principals, Object ACL configuration, Website or distribution path, Default encryption, Longest pre-signed URL lifetime, Objects in the bucket, Data stored in the bucket, Data classification. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Only while it stays on. Block Public Access is an override, not a fix — the moment somebody disables it for a legitimate static-site migration, the wildcard bucket policy underneath becomes live. That is why this calculator scores both paths and does not zero the policy points when Block Public Access is enforced.
As bearer tokens, because that is what they are: anyone holding the URL has the permissions of the signer until it expires. Keep the lifetime under an hour, sign with a short-lived role rather than a long-lived key, and never log the full URL.