Infrastructure Scanners Can Silently Misreport S3 Security Due to Failed API Calls

A software engineer discovered a critical data-integrity flaw in infrastructure scanning tools, including their own platform Infrawise, where failed AWS API calls were being recorded as false security findings rather than as errors. When a scanner lacks permission to read S3 bucket configurations, AccessDenied responses were defaulting to values like encrypted: false, making unread buckets appear insecure. This meant audit reports could flag buckets for missing encryption or versioning even when those properties were never actually checked. The fix involves introducing a third null state to distinguish a confirmed observation from an unread result, preventing false findings from being generated on incomplete data. However, the engineer also noted that some AWS APIs signal real absences through specific error codes, requiring those exceptions to be handled individually rather than collapsed into a generic null fallback.