Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
AWS CLI - S3 Bucket Investigation
Mission
Analyze the S3 configuration audit under `/challenge/s3_audit/`. Inspect each bucket's `*_acl.json`, `*_policy.json`, and `*_objects.json`, and identify the single genuinely public bucket whose `PublicAccessBlock` is all false and whose policy grants `Principal:*` + `Allow` + `s3:GetObject` on the whole bucket (`/*`). The flag is in the object_preview of that bucket's `prod.env`. Near-miss buckets (effectively blocked by BPA, empty, or narrowly scoped) are decoys.
Hints
Hint 1 Show
Audit each bucket's PublicAccessBlock and policy/ACL in s3_audit/; most are properly secured
Hint 2 Show
Exactly one bucket has PublicAccessBlock all-false AND a policy granting Principal:* / Allow / s3:GetObject on the whole bucket
Hint 3 Show
The flag is in that bucket's exposed sensitive object (prod.env) preview