Block unintended public access
Disable public access at the bucket or account level when the platform supports it. Inspect access policies, website hosting options, object ACLs, and signed URL behavior so a setting in one layer does not override another.
Use separate buckets or prefixes for public assets and private user data. This makes the intended boundary easier to review and reduces the chance that a future upload inherits overly broad permissions.
Grant access narrowly
Use identity-based permissions tied to specific buckets, prefixes, and actions. Applications that only read objects should not receive delete or policy-management rights, and human administrative credentials should not be embedded in client code.
Audit access logs and test representative URLs from an unauthenticated session. Rotate exposed credentials, remove obsolete grants, and include privacy checks in deployment review whenever bucket policies or delivery configuration change.