It’s probably a bridge too far, but at this point, Amazon should be scanning for PI and other key indicators of sensitive data and proactively disabling public access for these buckets (if only from a reputational risk perspective) instead of waiting for researchers to find through hunting and scanning, and then reporting to the media.