Inventory every path that grants access
Review bucket policies, object ACLs, public-access blocks, website hosting settings, and signed-link behavior. Check whether a broad wildcard principal or anonymous read permission applies through inheritance or a default configuration.
Separate public assets from private customer data into different buckets or prefixes with distinct policies. This reduces the chance that a change intended for images or downloads also exposes backups, exports, or uploaded documents.
Verify exposure from outside
Use an unauthenticated request from a clean session to test representative object URLs, listing behavior, and metadata. Do not rely only on the console label; confirm the effective result through the same public path an outsider could use.
Set alerts or periodic checks for policy changes and review deployment templates that can recreate bucket permissions. If exposure is found, restrict access promptly, then assess what was reachable and whether credentials or content need rotation or notification.