# visionstory S3 — data structure + data-protection posture (2026-08-14, read-only)
# sources: visionstory_s3_dataprotection.json + census + structure probes

## Data structure (per bucket)
- transfer.visionstory (729 GB): prefixes s3clon/ + s3clone/ + loose zips (compress_podcast_image, scene_8.zip, video_test.npy) — BULK TRANSFER/DUMP zone (s3-clone from another storage + ad-hoc archives). NPY = numpy data (ML samples).
- cdn-visionstory (11.3 GB, 27 prefixes): static site + user content — ad_video/, audios/, avatar_story/, creative_video/, f_assets/, imgs/, mat_design/, model-eval/, music/ + /media/cephfs1/.../discord/artifacts/*.mp4 (AI-generated user videos)
- ses-inbox-415114858646: single prefix inbox/ with raw SES email blobs (.eml)
- visionstory-logs: AWSLogs/415114858646/elasticloadbalancing/... ELB access logs (gz)
- webapp/web/affiliate/proxy-web-static: Nuxt SPA static sites (.html/.js/.css)

## Data protection (backup/versioning/replication/lock)
| bucket | versioning | lifecycle | replication | object-lock |
|---|---|---|---|---|
| cdn-visionstory | ENABLED | none | none | none |
| visionstory-logs | ENABLED | none | none | none |
| webapp-visionstory | ENABLED | none | none | none |
| web-visionstory-ai | ENABLED | none | none | none |
| web.darlite.me | ENABLED | none | none | none |
| affiliate-visionstory-ai | ENABLED | none | none | none |
| affiliate-darlite-me | ENABLED | none | none | none |
| proxy-web-static-prod-us-west-2 | ENABLED | present (noncurrent expire 90d + abort MPU 7d) | none | none |
| ses-inbox | DISABLED | present (expire inbox/ after 30 days!) | none | none |
| transfer.visionstory | DISABLED | none | none | none |
| cdn-visionstory-logs | DISABLED | none | none | none |
| webapp-darlite | DISABLED | none | none | none |

## Key findings
- NO backups: 0 buckets with replication, 0 with object-lock (no immutability), no cross-account/region copy.
- Versioning ENABLED on 8 buckets = deleted-object recovery possible (cdn-visionstory has version-ids, 0 delete-markers on first page -> no recent mass-deletion yet).
- ses-inbox: lifecycle auto-expires inbound email after 30 days (data disappears by design — relevant for evidence capture urgency).
- transfer.visionstory (729 GB dumps) has NO versioning — single copy, deletable.
- proxy-web-static-prod (us-east-1 region redirect 301) — region mismatch, sits at s3.amazonaws.com endpoint.
- MFA delete: not present on any (only default).

## Assessment
Ransomware/destructive angle: 8 versioned buckets give soft-delete protection, but transfer (729GB) + ses-inbox + logs are unversioned = wipe-permanent. No object-lock = full delete possible with this key.

**UPDATE 2026-08-17 — write-permission CONFIRMED**: key `AKIAWBJWGCCLDPFUDWO6` (user s3-user) has s3:PutObject + s3:DeleteObject + s3:DeleteObjectVersion + s3:GetObject on both unversioned (transfer) and versioned (cdn) buckets (see write_proof.json). DeleteObjectVersion on versioned buckets means versioning does NOT protect against permanent wipe — attacker can delete all versions of all objects. Combined with 0 replication + 0 object-lock across all 13 buckets: **full destructive capability over the entire S3 estate is proven, including permanent deletion of the 729GB transfer dump and all versioned content.**