An infrastructure audit runs across your account and comes back with two findings on S3. You fix both, close the ticket, and move on.
What the report did not tell you is that the role running it lacks s3:GetEncryptionConfiguration. Fourteen buckets returned AccessDenied on that call. The tool caught the rejection, wrote encrypted: false, and moved on to the next bucket. Some of those fourteen are encrypted. Some are not. The report cannot tell you which, because the value it printed was not read from AWS — it was the default that got assigned when the read failed.
This is the bug I spent a release fixing across Infrawise, and it is not really an S3 bug. It is a shape-of-data bug that almost every infrastructure scanner has somewhere: a boolean field with two states being asked to carry three.
false is a claim, and a failed call has no claim to make
The S3 extractor issues four calls per bucket — notifications, versioning, encryption, public access block — through Promise.allSettled, so one rejection never takes down the other three:
