All Tools View Categories About Contact Privacy

Public S3 Bucket Policy Detector

Paste a resource policy and find Allow statements exposed to "*" — anyone on the internet.

Heuristic screening only — flags known public-principal patterns from a curated, non-exhaustive check. Absence of a finding does not mean the policy is safe. Runs entirely in your browser; not a substitute for AWS IAM Access Analyzer or a professional review.

About Public S3 Bucket Policy Detector

Public S3/Resource Bucket Policy Detector scans a pasted resource-based policy (an S3 bucket policy, or any other resource policy that uses a Principal element) for Allow statements that grant access to "*" — the special principal value that means "any AWS principal, or literally anyone, depending on context," i.e. the internet at large. This is one of the single most common and most dangerous S3 misconfigurations: a bucket policy statement with "Principal": "*" and no restricting condition makes the affected actions available to anyone who finds the bucket, not just your own account.

Each match is classified by risk: high when the public statement has no Condition block at all (fully public, no exceptions), and medium when a Condition block is present, since a condition narrows who "*" resolves to in practice — but this tool does not attempt to judge whether the specific condition you wrote is actually restrictive. A condition that requires aws:SourceIp = 0.0.0.0/0, for example, restricts nothing, and this tool has no way to tell the difference between that and a genuinely narrow condition; it only checks whether a Condition key is present at all.

This is a heuristic check against one known pattern, not a full bucket-exposure audit — it has no visibility into S3 Block Public Access settings, bucket ACLs, cross-account grants outside the policy JSON, or anything else that determines real-world accessibility. Treat a clean result as "no public-principal Allow statement in the JSON you pasted," not as "this bucket is private."

Features

  • Detects public Principal patterns: "*", {"AWS":"*"}, and arrays containing "*".
  • High vs. medium risk classification based on whether a Condition block is present.
  • Plain-English "why this matters" note per finding.
  • Sample risky policy to see the detector work immediately.
  • 100% client-side — nothing is uploaded.

How to Use

  1. Paste a resource-based policy (S3 bucket policy or similar) into the box, or click the sample.
  2. Click Detect.
  3. Review each flagged statement — its index, Sid (if any), risk level, and a plain-English explanation.
  4. If nothing is flagged, remember this only means no public-principal pattern was found in what you pasted — it is not a full exposure audit.

Examples

Example 1 — fully public, no condition. {"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"} → flagged high: anyone on the internet can read every object in the bucket.

Example 2 — public but IP-restricted. The same statement with "Condition":{"IpAddress":{"aws:SourceIp":"203.0.113.0/24"}} → flagged medium: still worth reviewing, but narrowed to a specific network range (assuming the range itself is intentional and tight).

Example 3 — scoped to your account. "Principal":{"AWS":"arn:aws:iam::123456789012:root"} → not flagged; this only grants access within the named account.

Benefits

  • Catches the single most common S3 misconfiguration in seconds instead of manual JSON review.
  • Separates fully-open from conditionally-scoped exposure so you know what to prioritize.
  • Plain-English explanation per finding, not just a JSON dump.
  • Private — the policy never leaves your browser.

Frequently Asked Questions

What exactly counts as a "public" Principal?
A statement is flagged when its <code>Principal</code> is the literal string <code>"*"</code>, or <code>{"AWS":"*"}</code>, or an array of AWS principals that contains <code>"*"</code>. Any of those means "anyone on the internet, authenticated or not" as far as IAM policy evaluation is concerned.
Why is a statement with a Condition still flagged, just at "medium" instead of cleared?
A <code>Condition</code> block (e.g. restricting by <code>aws:SourceIp</code> or <code>aws:PrincipalOrgID</code>) narrows who <code>"*"</code> actually resolves to, so it is genuinely less exposed than an unconditional public statement. But this tool does not evaluate whether the specific condition you wrote is actually restrictive — a condition like <code>StringEquals: {"aws:SourceIp": "0.0.0.0/0"}</code> restricts nothing at all. Always read the condition yourself.
Does this tool check whether the bucket is otherwise private (e.g. Block Public Access settings)?
No. This tool only reads the JSON policy document you paste. It has no access to your account’s S3 Block Public Access configuration, bucket ACLs, or any other setting that could affect real-world exposure.
Is this a complete security audit?
No. This flags one specific, well-known heuristic pattern — public Principal in an Allow statement — from a narrow, non-exhaustive check. Absence of a finding does not mean the policy or bucket is safe. Use this as a fast first-pass screening aid, not a substitute for AWS IAM Access Analyzer or a professional security review.
Does Deny matter here?
This tool only inspects Allow statements, matching how the underlying detector works. A separate explicit Deny elsewhere in the policy (or in an SCP) could still block the exposure in practice — this tool does not attempt to resolve that interaction; it only tells you an Allow statement grants access to "*".
Is my policy sent anywhere?
No — detection runs entirely in your browser.