Private by Default

A storage bucket holds files for an application. Its access policy was written to get things working quickly, and it grants access to everyone: anyone on the internet may read the files, and anyone may upload new ones. Publicly writable and readable storage is behind a long list of real data leaks.

Edit the policy so the bucket is private by default. Look at each statement and ask who it names, what it lets them do and whether they need to. The application's own service must keep the access it needs to read and write the files, but with the specific actions it uses rather than a wildcard. The checker inspects the document and reports each statement that is still too broad.

Do not solve this by deleting the whole policy: the application must still work. When no wildcard principal or action remains and the service keeps its access, you receive the flag. The lab only reads the text you submit; nothing is applied to a real system, and the check tells you what is still weak and why, never the exact line to type.