--- title: S3 Compatibility Doesn't Guarantee S3-Level Security description: A Wiz security research report examined S3-compatible object storage offerings from six neoclouds—Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and... canonical: https://daily.dev/posts/s3-compatibility-doesn-t-guarantee-s3-level-security-mor31muje twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: S3 Compatibility Doesn't Guarantee S3-Level Security | daily.dev og:description: A Wiz security research report examined S3-compatible object storage offerings from six neoclouds—Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and... og:url: https://daily.dev/posts/s3-compatibility-doesn-t-guarantee-s3-level-security-mor31muje og:image: https://api.daily.dev/og/posts/mOR31MUJE.png og:image:alt: S3 Compatibility Doesn't Guarantee S3-Level Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # S3 Compatibility Doesn't Guarantee S3-Level Security **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 0 upvotes · 0 comments ## Summary A Wiz security research report examined S3-compatible object storage offerings from six neoclouds—Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean—and found significant security gaps compared to Amazon S3. Public bucket controls vary widely: Crusoe and Lambda Labs disallow public access entirely, while DigitalOcean supports publicly listable buckets and Vultr supports both ACLs and bucket policies. Access keys for these S3-compatible services often lack structured formats and secret-scanning support, making leaked credentials harder to detect by tools like GitHub. IAM semantics also diverge, contributing to real vulnerabilities such as a MinIO privilege-escalation flaw and a RustFS CVE breaking tenant isolation. On one unnamed provider, running delete-bucket-policy reportedly deleted the entire bucket. Researchers warn organizations not to assume AWS security guarantees, like Block Public Access, carry over to S3-compatible clones, and recommend auditing API behavior and permission models before relying on standard AWS tooling against these endpoints. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Do S3-compatible object storage services from providers like Nebius, Crusoe, or DigitalOcean have the same security protections as Amazon S3? No, research from Wiz found significant gaps. Crusoe and Lambda Labs lack public-access capabilities entirely, while Nebius and Cloudflare R2 allow public buckets but block anonymous object listing, and DigitalOcean supports publicly listable buckets while Vultr supports both ACLs and bucket policies for public access, none matching AWS S3's Block Public Access controls fully. _Teams weighing neocloud storage against AWS S3 can track findings like these on daily.dev before trusting default assumptions._ ### Why can't secret scanning tools like GitHub's detect leaked access keys for S3-compatible cloud storage services? Many S3-compatible services lack the structured access-key formats that AWS uses, so tools like GitHub's secret scanning, which relies on recognizable credential patterns, cannot reliably detect them. GitHub does detect some credentials for DigitalOcean and Cloudflare, but not consistently across all S3-compatible providers, and other secret scanners face the same pattern-matching limitation. _Developers securing credentials across multiple cloud providers can follow coverage of gaps like this on daily.dev._ ### What known vulnerabilities have affected IAM and access control in S3-compatible object storage implementations like MinIO and RustFS? MinIO had a vulnerability enabling unauthorized privilege escalation attacks, and RustFS had a vulnerability that broke tenant isolation and authorization semantics. These issues reflect broader inconsistencies in how IAM capabilities and permission semantics are implemented across different S3-compatible storage systems compared to AWS S3's mature IAM model. _Anyone auditing self-hosted object storage security can keep up with disclosures like these via daily.dev._ ## Similar posts on daily.dev - [How S3 API compatibility lets you use any cloud](https://daily.dev/posts/how-s3-api-compatibility-lets-you-use-any-cloud-kl0czr04a) · Tigris · 1 upvotes · 0 comments - [Ransomware gangs find a new hostage: Your AWS S3 buckets](https://daily.dev/posts/ransomware-gangs-find-a-new-hostage-your-aws-s3-buckets-jrroenldx) · CSO Online · 0 upvotes · 0 comments - [Cloud ops is different in a neocloud](https://daily.dev/posts/cloud-ops-is-different-in-a-neocloud-kttmuns3u) · InfoWorld · 0 upvotes · 0 comments - [Bucketsquatting is \(Finally\) Dead – One Cloud Please](https://daily.dev/posts/bucketsquatting-is-finally-dead-one-cloud-please-rolnb5btt) · Hacker News · 0 upvotes · 0 comments - [Alternatives to MinIO for single-node local S3](https://daily.dev/posts/alternatives-to-minio-for-single-node-local-s3-blaru37xq) · Lobsters · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#aws-s3](https://daily.dev/tags/aws-s3), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/s3-compatibility-doesn-t-guarantee-s3-level-security-mor31muje) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"S3 Compatibility Doesn't Guarantee S3-Level Security","url":"https://daily.dev/posts/s3-compatibility-doesn-t-guarantee-s3-level-security-mor31muje","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/s3-compatibility-doesn-t-guarantee-s3-level-security-mor31muje"},"datePublished":"2026-08-21T08:46:47.084Z","dateModified":"2026-09-13T19:08:34.223Z","description":"A Wiz security research report examined S3-compatible object storage offerings from six neoclouds—Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee6b0e02acf93f588d4b23c2fe65fe4c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee6b0e02acf93f588d4b23c2fe65fe4c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/s3-compatibility-doesn-t-guarantee-s3-level-security-mor31muje","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,aws-s3,iam","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"S3 Compatibility Doesn't Guarantee S3-Level Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/s3-compatibility-doesn-t-guarantee-s3-level-security-mor31muje#faq","mainEntity":[{"@type":"Question","name":"Do S3-compatible object storage services from providers like Nebius, Crusoe, or DigitalOcean have the same security protections as Amazon S3?","acceptedAnswer":{"@type":"Answer","text":"No, research from Wiz found significant gaps. Crusoe and Lambda Labs lack public-access capabilities entirely, while Nebius and Cloudflare R2 allow public buckets but block anonymous object listing, and DigitalOcean supports publicly listable buckets while Vultr supports both ACLs and bucket policies for public access, none matching AWS S3's Block Public Access controls fully. Teams weighing neocloud storage against AWS S3 can track findings like these on daily.dev before trusting default assumptions."}},{"@type":"Question","name":"Why can't secret scanning tools like GitHub's detect leaked access keys for S3-compatible cloud storage services?","acceptedAnswer":{"@type":"Answer","text":"Many S3-compatible services lack the structured access-key formats that AWS uses, so tools like GitHub's secret scanning, which relies on recognizable credential patterns, cannot reliably detect them. GitHub does detect some credentials for DigitalOcean and Cloudflare, but not consistently across all S3-compatible providers, and other secret scanners face the same pattern-matching limitation. Developers securing credentials across multiple cloud providers can follow coverage of gaps like this on daily.dev."}},{"@type":"Question","name":"What known vulnerabilities have affected IAM and access control in S3-compatible object storage implementations like MinIO and RustFS?","acceptedAnswer":{"@type":"Answer","text":"MinIO had a vulnerability enabling unauthorized privilege escalation attacks, and RustFS had a vulnerability that broke tenant isolation and authorization semantics. These issues reflect broader inconsistencies in how IAM capabilities and permission semantics are implemented across different S3-compatible storage systems compared to AWS S3's mature IAM model. Anyone auditing self-hosted object storage security can keep up with disclosures like these via daily.dev."}}]} ```