Granular Analysis
By tracking every S3 API call by bucket, operation type, and source, the analysis revealed that 92% of GetObject calls originated from a single bucket. This led to the identification of an overactive S3 sync job in development, responsible for 80% of the traffic, and unauthorized third-party downloads accounting for 15% of the traffic.