# S3Scanner: finding exposed cloud storage buckets

> How to install and run S3Scanner, and how Tandera uses it for unauthenticated cloud footprint enumeration.

`S3Scanner` checks whether cloud storage buckets exist and what permissions they expose. It covers S3 and S3-compatible providers, and reads permissions without needing credentials for the target account.

## Install

```bash
pipx install s3scanner
# or
docker run --rm ghcr.io/sa7mon/s3scanner scan --bucket example-assets
```

## Core commands

```bash
# one bucket
s3scanner scan --bucket example-assets

# a candidate list
s3scanner scan --buckets-file candidates.txt

# generate candidates from a company name
s3scanner scan --bucket-name-file names.txt --enumerate

# JSON output
s3scanner --json scan --buckets-file candidates.txt > buckets.json

# non-AWS providers
s3scanner --endpoint-url https://storage.googleapis.com scan --bucket example-assets
```

## Output

```json
{"bucket":"example-assets","exists":true,"region":"us-east-1",
 "permissions":{"AuthUsers":{"read":true,"write":false},"AllUsers":{"read":true,"write":false}}}
```

`AllUsers.read: true` means anonymous read. That is the finding.

## Where it sits in Tandera

S3Scanner is the core of `recon_cloud_enum` — the unauthenticated cloud-footprint flow that runs from a domain seed and needs no access to the client's cloud account. That distinguishes it from `recon_cloud`, which runs `prowler` and `scoutsuite` against an authenticated, already-connected account.

It runs in **discovery**, alongside `cdncheck`.

## Using it in a pentest

**Read the permission, do not exercise it.** Confirming `AllUsers.read` is the finding. Downloading the contents is data handling you were probably not authorised to do, and it changes the engagement's legal posture. Capture the permission state as evidence and stop.

**Write permission is a critical, always.** `AllUsers.write` on a bucket serving a website is site defacement or supply-chain compromise. It outranks almost anything else you will find that day.

**Guess names from what you already have.** Bucket names mirror the organisation: `example-assets`, `example-backups`, `example-prod-logs`. Build the candidate list from hostnames your recon already produced rather than a generic list.

**Buckets belong to accounts, not domains.** Verify a bucket is actually the client's before reporting it. Name similarity is not ownership.

---

Canonical: https://tandera.io/tools/s3scanner
This page as markdown: https://tandera.io/tools/s3scanner.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.