Skip to main content
Rightsizing · Low severity

Large S3 Bucket with External Access, Consider Requester Pays

With Requester Pays the downloader is billed for the request and the transfer instead of the bucket owner, which is the point of the setting for datasets shared outward.

Sign inExplore the playground

Free to start. No card. The playground just needs your work email.

AWSprovider
Lowseverity
Savingswhere it shows up
Manualfix, steps written out

AWS

Found, explained, handed over.

Findings with a dollar figure attached, idle, oversized, orphaned, unscheduled and undiscounted spend.

01

Detect

ZopNight checks this automatically across AWS, with read-only access to the account.

02

Explain

Every finding says exactly what to change: Enable Requester Pays on the S3 bucket. Where the saving can be proven it is priced; where it cannot, the finding says so.

03

Fix

The finding opens with the fix already written out, step by step, so it is one ticket, not an investigation.

Applies to
S3 Buckets on AWS
The fix, by hand
  1. Confirm external consumers can authenticate with their own AWS credentials. Requester Pays requires authenticated requests only (anonymous access is blocked).
  2. Notify consumers they must add x-amz-request-payer: requester header (or --request-payer requester on CLI) to every GET/PUT.
  3. S3 → bucket the resource → Properties → Requester Pays → Edit → Enable.
  4. Monitor S3 server access logs / CloudTrail for the next week; 403 errors from consumers that haven't updated their clients are common.
  5. Update the bucket's README / consumer-facing docs to call out the header requirement.

These are the steps the finding carries in the product.

Category
Rightsizing. Resources sized for headroom they never use. A smaller size runs the same workload for less.
Where it appears
The Savings tab of Recommendations, with every affected resource listed.
Rule ID
RC-175
Full reference

Large S3 Bucket With External Access -- Consider Requester Pays

Related checks

S3 Bucket with Public Access EnabledAWSS3 Bucket Not Requiring HTTPSAWSS3 Bucket Access Logging Not EnabledAWSS3 Incomplete Multipart Uploads AccumulatingAWSS3 Bucket Lifecycle Policy MissingAWSS3 Glacier Objects, Consider Deep ArchiveAWS

See the oversized resources in your account.

Connect a read-only role and the first pass runs on your own estate. This check, and the rest of the catalogue, with it.

Start freeExplore the playground

Prefer to talk it through first? Book 20 minutes with the team.

  • $30M+annualised cloud spend under management
  • 550K+resources tracked since launch
  • 20-60%off the bill in the first month
  • SOC 2Type II report, plus ISO 27001

Figures published on zop.dev.

Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·