AMAZON S3 BLOCK PUBLIC ACCESS BYPASS

Summary from the TLDR InfoSec newsletter

A group of researchers discovered a method to bypass AWS’ Block Public Access protections in a way that will not be detected by AWS. The method requires using a Customer Managed KMS key and a permissive bucket policy.