Several weeks ago, the Wall Street Journal ran an article about how the Pokémon Company inspects the security practices of its business partners. One prospective unnamed partner had insufficient controls around S3 buckets, so the Pokémon Company declined to partner with them.
This is the first time I've ever heard of a company taking such a position. To that end, I'm pleased to award them the first ever S3 Bucket Responsibility Award, which was delivered to their office. They set an example that we can all strive to emulate.