Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Deleted an S3 Bucket, but can still access a file from that bucket

0

We had a bucket in S3 Called template.crystalgraphics.com I emptied the bucket, and deleted the bucket on 6/3/2025. Then I found someone in Indonesia was using the bucket for a file on their website. Here is the URL: https://s3.amazonaws.com/template.crystalgraphics.com/index.html Note that in the S3 Console, the 'template.crystalgraphics.com' bucket does not show up. (Probably because I deleted it). Do you know how come the URL above still works? And How could someone put the index.html file into that bucket? We upload files using the API. Perhaps they found our Access Key. (I will change our keys)

I'll appreciate your help.

George

Topics
Security, Identity, & Compliance
Tags
AWS IAM Identity CenterAWS Identity and Access Management
Language
English

asked a year ago318 views

1 Answer
0

Hello.

Did you already delete the S3 bucket in your AWS account?
In this case, it will be possible to create an S3 bucket in another AWS account, so it is possible that someone other than you has created an S3 bucket with the same name in another AWS account.
https://docs.aws.amazon.com/prescriptive-guidance/latest/defining-bucket-names-data-lakes/faq.html

If you delete an Amazon S3 bucket and want to create a new bucket with the same name, you must wait for the name to become available again. It can take 48–72 hours for the changes to take effect. It's a best practice to wait at least 48 hours before creating a new bucket that reuses a previous name. Amazon S3 bucket names are globally unique, and all AWS accounts share the same namespace.

As described in the document below, why not try contacting us using the abuse form?
https://repost.aws/knowledge-center/report-aws-abuse

Use the Report Amazon AWS abuse form to report suspected abuse of AWS resources.
The AWS Trust & Safety team can assist you when AWS resources are implicated in the following abuse types:

  • Web content/non-copyright intellectual property that's objectionable content hosted on an AWS resource. The content might be a webpage, image, video, or some other form of internet content. Be sure to provide the URL of the content and a brief comment indicating why you believe the content to be abusive. If the content is a video, then also provide the timestamp in the video where the objectionable content can be located.
  • Email abuse that's an abusive email sent from an AWS resource or spam content hosted on, or sent from an AWS resource. Be sure to provide the full email header and HTML body for investigation.
  • Network activity that's originating from an AWS resource that causes problematic network traffic. This can be an intrusion attempt, denial-of-service (DoS) attack, port scanning, or any other abusive network activity. Be sure to provide the network logs showing the activity and the source and target IP addresses, ports, and timestamps.
  • Copyright that's subject to content removal requests regarding the Digital Millennium Copyright Act.
EXPERT

answered a year ago

  • George
    a year ago

    Thank you for your answer. I was wondering how they could upload a file to a bucket that I had deleted, and one that no longer appears in our bucket list, and now I understand how. I submitted an abuse report. Thanks so much for your help!

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content