Cloud Engineer interview question · Most asked
How do you keep object storage buckets from being exposed publicly?
Summary
Enable account-level Block Public Access (and prevent disabling it with an SCP), keep ACLs disabled, serve public content through a CDN with a private origin (CloudFront origin access control), share private files with short-lived presigned URLs, separate buckets by data classification, and monitor with Access Analyzer and Macie. Azure: disallow anonymous blob access; Google Cloud: public access prevention and uniform bucket-level access.
Longer Answer
Public exposure usually comes from a quick fix that outlives its purpose, or from a bucket's contents changing while its policy doesn't.
Key Points
- Block public access at account level.
- CDN with private origin.
- Presigned URLs for private files.
- Separate data and monitor.
Deep dive: Cloud Engineering in Production: The Bucket Anyone Could List
Explanation
What interviewers look for
Preventive and detective controls, with multi-cloud equivalents.
More most-asked Cloud Engineer questions
- What do Multi-AZ deployments and read replicas give you for managed databases?
- How is an AWS IAM request evaluated when several policies apply?
- What are regions and availability zones, and how do you use them for resilience?
- How do you eliminate long-lived credentials in a cloud environment?
- How do you approach cloud cost optimisation?
- Explain RTO and RPO and the four disaster recovery strategies.
- How would you design a multi-account (landing zone) structure?
- What security services and settings belong in every cloud account from day one?