Cloud Security
S3-Compatible Services Often Lack AWS's Security Guardrails
Researchers found that object storage services claiming S3 compatibility implement inconsistent and weaker security controls than Amazon's original platform.
InfoQ
Security researchers at Wiz recently analyzed S3-compatible object storage offerings from six providers and discovered that compatibility with Amazon's API does not translate to equivalent security protections. Although S3 has become the industry standard for object storage, many alternative services omit or implement key security features differently.
What the Research Found#
The investigation compared managed services from Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean against Amazon S3. The findings reveal substantial variation in how these platforms handle fundamental security controls:
- Public bucket access: Crusoe and Lambda Labs lack any public-access capabilities; others provide fewer controls than AWS S3's Block Public Access
- Access credentials: S3-compatible services often use credential formats that secret-scanning tools cannot reliably detect, unlike AWS's structured formats recognized by GitHub and other scanners
- IAM controls: Permission models and authorization semantics differ substantially across implementations, leading to real vulnerabilities—including one in MinIO enabling unauthorized privilege escalation
The Scope of S3's Feature Set#
S3 encompasses roughly 300 related APIs across multiple services built over more than 20 years of development. Principal cloud security researcher Scott Piper at Wiz notes that most S3 clones have replicated only a fraction of this functionality. As Piper explains, organizations cannot assume their alternative platform operates identically to AWS—some behaviors diverge in unexpected ways.
Critical Gaps in Practice#
The research uncovered specific vulnerabilities. One S3-compatible service was found to delete an entire bucket when users called the command, a behavior that would never occur on AWS. Additionally, because these platforms inherit presigned URL support from the S3 specification, the same security implications apply—but teams may not recognize the risks they've accepted by switching providers.
