[Zombieball]

> and the bucket itself had no protection against outside access with a compromised key

Any advice on how to safeguard against this?

[jhugo]

Don't use static keys, and audit access to sensitive resources.

If possible, use VPC endpoints and lock down the bucket to only allow access from them.