Imagine that during an engagement you come across a static website, with only an image on the home page and standard files from a frontend framework. You have already reviewed them and found no sensitive information, no route or anything relevant. You have also found (maybe while analyzing HTTP headers) that the server is behind the Cloudfront CDN. End of the line, right? Or maybe not... Also imagine that, by intuition, you suspect that there is an AWS S3 bucket behind the CDN, serving static files.