● Covered by 1 source · 1 reportMedium impact1 negative
Wiz Report Finds S3-Compatible Object Storage Services Have Significant Security Gaps
Key points
- Wiz researchers compared S3-compatible services from six neoclouds to Amazon S3.
- S3-compatible services often lack AWS's security protections and least-privilege features.
- Public bucket handling and access key formats vary significantly, impacting security.
- IAM capabilities in S3-compatible implementations differ, leading to vulnerabilities.
S3 Compatibility Does Not Equal S3 Security
Security researchers at Wiz examined S3-compatible object storage services from Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean. The study found that these services have significant security gaps compared to Amazon S3, which has become the industry standard for object storage. Organizations using S3-compatible services cannot rely on the same security assumptions as AWS S3.
Reduced Protections and False Portability
Scott Piper, principal cloud security researcher at Wiz, highlighted that S3 compatibility creates a false sense of portability. Amazon S3 has nearly 300 APIs and specialized functionality developed over 20 years. Many S3-compatible services do not replicate this functionality, and some operate in unexpected ways, leading to reduced security protections and limited least-privilege capabilities.
Variations in Public Bucket Handling
The report detailed significant differences in how S3-compatible services manage public buckets. Crusoe and Lambda Labs do not offer public-access capabilities. Other providers, such as Nebius and Cloudflare R2, allow public buckets but restrict anonymous object listing. DigitalOcean supports publicly listable buckets, and Vultr offers both ACLs and bucket policies for public access, but these often provide fewer controls than AWS S3's Block Public Access.
Access Key and IAM Discrepancies
S3-compatible services frequently lack the structured access-key formats and secret-scanning support available for AWS credentials. This makes it harder for security teams and tools like GitHub's secret scanning to detect these credentials. Additionally, IAM capabilities and semantics vary considerably among S3-compatible implementations, which has contributed to reported vulnerabilities, including privilege escalation flaws in MinIO and RustFS.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub en/code-security GitHub mixpeek/awesome-object-storage CVE CVE-2026-499918.6 HIGHReporting from
A Wiz report reveals that S3-compatible object storage services from six neocloud providers lack many security protections found in Amazon S3, leading to potential vulnerabilities. This matters because organizations using these services cannot assume AWS-level security and must adjust their security practices to account for reduced protections and limited least-privilege capabilities.