Scan many S3 buckets for exposed sensitive files

aws-s3-data-finder works through a large list of S3 bucket names and, for every one it can list, writes out the first chunk of keys it finds. Among those keys it flags the suspicious files: data backups, PII dumps, and credential files that should never sit in a readable bucket.

It runs authenticated through the AWS CLI, using your account's region, or unauthenticated over plain HTTP against a chosen endpoint, so it covers both buckets you own and public ones you are testing for exposure. Bucket names come from a list, a single name, or candidates you generate with random and brute-force characters, prefixes, and postfixes.

On Trickest, aws-s3-data-finder is a Discovery node that takes a bucket list and writes a file plus a folder, with listable buckets dumped under buckets/ as JSON or XML. Put a bucket-name generator upstream and a secret scanner like noseyparker downstream to confirm what leaked.