# S3 bucket disclosure

**URL:** <https://discuss.openedx.org/t/s3-bucket-disclosure/10470>\
**Category:** Site Operations Help\
**Created:** [June 20, 2023, 5:29am UTC](https://discuss.openedx.org/t/s3-bucket-disclosure/10470 "2023-06-20T05:29:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Komal\_Raval](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/komal_raval/32/4153_2.png) [@Komal\_Raval](https://discuss.openedx.org/u/Komal_Raval)\
**Post date:** [June 20, 2023, 5:29am UTC](https://discuss.openedx.org/t/s3-bucket-disclosure/10470/1 "2023-06-20T05:29:10Z")

</div>

Hello Everyone,

Listing method is enabled Attacker can able to download whole data from bucket,(Video transcripts, Profile  
images, all certificates) can we make s3 bucket private?  
Please suggest any solution.

Thanks in Advance 🙂

---

<div class="post-metadata">

**Author:** ![Anh\_Vu\_Nguy\_n](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/anh_vu_nguy_n/32/1740_2.png) [@Anh\_Vu\_Nguy\_n](https://discuss.openedx.org/u/Anh_Vu_Nguy_n)\
**Post date:** [June 20, 2023, 7:33am UTC](https://discuss.openedx.org/t/s3-bucket-disclosure/10470/2 "2023-06-20T07:33:40Z")

</div>

if your instance is public then your static data like (course images, videos,…) are public, people are free to download it so there are no points to restrict it.

I guess your instance is private and you only want your users to access your S3 files. You can use these methods to somewhat make it harder for attackers

- CORS.
- CloudFront function (if you use AWS CloudFront).
- Make file names unpredictable.

Get Objects permission is enough to retrieve files, you don’t need List Objects, if you want, you can grant List Objects permission to a specific IAM user.

The S3 bucket for course data like student submissions should be private, an access token will be used to retrieve files.

Course static files uploaded in Studio (Content \> File & Upload) are not stored in S3.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/e/e0015f89e879bc75925b71fd11133ab15fe98297.png) [@system](https://discuss.openedx.org/u/system)\
**Post date:** [September 18, 2023, 7:34am UTC](https://discuss.openedx.org/t/s3-bucket-disclosure/10470/3 "2023-09-18T07:34:19Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.