- Setting bucket policies to grant public access
- Enabling server-side encryption for data at rest
- Disabling access logging and monitoring
- Storing encryption keys in plaintext format