A security review finds an object storage container whose access policy grants read permission to any authenticated user of the cloud provider, not only to identities in the company's own tenant. What is the most accurate assessment of this finding?
Select an answer to reveal the explanation.
Short Explanation
'Any authenticated user' sounds safe until you remember anyone can sign up for an account in minutes. That's basically a public bucket with a speed bump. You fix it by naming exactly who gets in, and you don't hide behind encryption at rest, because it decrypts for anyone the policy lets through.
Full Explanation
Object storage access is governed by policies and access control lists attached to containers and objects. A grant to every authenticated user of the provider means any person or workload with an account at that provider, in any tenant, can read the data, and creating an account is trivial. That is functionally close to public exposure and is one of the most common causes of cloud data leaks. The correct response is to restrict the policy to specific principals in the company's tenant, apply least privilege and enable controls that block broad or public grants. Treating authentication as sufficient protection ignores who is being authenticated; the policy does not limit it to the company's identities. Provider-side encryption at rest is transparent to authorized requests, so the service decrypts objects for any caller the policy permits; it protects against media theft, not policy misconfiguration. The exposure is not limited to provider staff, and configuring access policies is a customer responsibility in every service model, so shared responsibility places this squarely on the customer. Exam caveat: misconfiguration is consistently ranked among top cloud threats. Operational check: scan all containers for grants to broad principal groups and alert on any policy change that widens access.