S3

The methodaws s3 family of commands provide information about an account's S3 buckets and their contents.

Usage

methodaws s3 [command]

Available Commands

• enumerate: Gather information about all S3 buckets the provided credentials have access to
• list: List all objects in a single S3 bucket
• external: Enumerate a public facing S3 bucket from an external perspective

Commands

Enumerate

The enumerate command will gather information about all of the S3 buckets that the provided credentials have access to.

Access and Encryption Signals

configuration.accessControl.allowPublicList describes bucket-level listing permissions from the collected ACL and policy. allowPublicRead describes object-read permissions from the bucket policy, not listing or individual object ACLs. Bucket ACL READ and FULL_CONTROL grants populate listing permissions, including allowAuthenticatedUsersList for the AuthenticatedUsers group. These are configuration assessments, not proof of successful access to every object.

Each encryption rule retains the reported kmsKeyIdentifier, including aliases and bare key IDs. The separate kmsKey reference is populated only for a concrete key ARN; aliases are not resolved or treated as key ARNs.

Usage

methodaws s3 enumerate --regions us-east-1 --output json

Help Text

$ methodaws s3 enumerate -h
Enumerate all S3 buckets in your AWS account.

Usage:
  methodaws s3 enumerate [flags]

Flags:
  -h, --help   help for enumerate

Global Flags:
      --http-proxy string     HTTP/HTTPS proxy URL (e.g., http://proxy.example.com:8080)
  -o, --output string         Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string    Path to output file. If blank, will output to STDOUT
  -q, --quiet                 Suppress output
  -r, --regions stringArray   AWS Regions to search for resources. You can specify multiple regions by providing the flag multiple times. If blank, will search all regions.
      --socks-proxy string    SOCKS proxy URL (e.g., socks5://proxy.example.com:1080)
  -v, --verbose               Verbose output

list

Usage

methodaws s3 list --regions us-east-1 --output json --name <bucket name>

Help Text

$ methodaws s3 list -h
List all objects in a single S3 bucket.

Usage:
  methodaws s3 list [flags]

Flags:
  -h, --help          help for list
      --name string   Name of the S3 bucket

Global Flags:
      --http-proxy string     HTTP/HTTPS proxy URL (e.g., http://proxy.example.com:8080)
  -o, --output string         Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string    Path to output file. If blank, will output to STDOUT
  -q, --quiet                 Suppress output
  -r, --regions stringArray   AWS Regions to search for resources. You can specify multiple regions by providing the flag multiple times. If blank, will search all regions.
      --socks-proxy string    SOCKS proxy URL (e.g., socks5://proxy.example.com:1080)
  -v, --verbose               Verbose output

external

The external command attempts to enumerate a public-facing S3 bucket with anonymous credentials from an external perspective. Provide exactly one of --url or --target-seed.

allowDirectoryListing and allowAnonymousRead report anonymous probe results. Entries in acls describe the returned bucket ACL grants, not effective access after all applicable controls. A missing bucket policy is normal; failed optional policy or ACL requests are reported without discarding the identified bucket.

Usage

methodaws s3 external --url https://bucketname.s3.amazonaws.com --output json

# Generate and probe candidate bucket names
methodaws s3 external --target-seed example.com --max-candidates 100

Help Text

$ methodaws s3 external -h
Enumerate public-facing S3 buckets from an external perspective.

Usage:
  methodaws s3 external [flags]

Flags:
  -h, --help                 help for external
      --max-candidates int   Max candidate bucket names to probe when --target-seed is set (cap 500) (default 50)
      --target-seed string   Org/domain seed used to generate and probe candidate bucket names
      --url string           URL of a single S3 bucket to enumerate

Global Flags:
      --http-proxy string     HTTP/HTTPS proxy URL (e.g., http://proxy.example.com:8080)
  -o, --output string         Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string    Path to output file. If blank, will output to STDOUT
  -q, --quiet                 Suppress output
  -r, --regions stringArray   AWS Regions to search for resources. You can specify multiple regions by providing the flag multiple times. If blank, will search all regions.
      --socks-proxy string    SOCKS proxy URL (e.g., socks5://proxy.example.com:1080)
  -v, --verbose               Verbose output