Security controls need evidence. Encryption at rest, encrypted transport, access policy, and audit logging protect different parts of a workload. An audit trail can show who called an API, while application logs can explain a business event. Neither should contain secrets merely because they are useful during an incident.
When a bucket may have leaked, first contain the unwanted access path while preserving evidence. Then establish what was public, for how long, and which records are available. Do not promise that missing logs prove no one accessed the data. Least privilege and credential rotation can reduce further exposure, but they don't reverse a prior disclosure. These scenarios reward a checked containment step and a recommendation that acknowledges the limits of the evidence.