The access had been set for a temporary migration task. The task ended. Nobody reviewed the bucket. The access never changed.
No audit had flagged it. No scanner had been pointed at it. No one had been actively trying to find it.
That is the difference between compliance and security testing. Compliance checks whether controls are documented. Penetration testing checks whether controls actually hold when someone is looking for the gap.
Point is, Someone is always looking…👀