Using this cloud Bucket checker from Grayhat Warfare, you can search millions of cloud buckets that may be associated with the entity you are testing. This may allow you to find sensitive data.
For example, if your client is ACME, it is likely that their buckets may be named zyx-application-acme.
