My instructor placed grade sheets for our first two projects into a "Dropbox" file system which has absolutely no access control. So not only every student could see every other student's grades and written assessments, but anyone walking into the college library could sit down at a computer and look at our grades without having to present any kind of credentials whatsoever.
FERPA prohibits public posting of grades together with students' names or social security numbers (including last 4 digits of SSN). (This prohibition includes, but is not limited to, posting grades where other students in the class can see one another's grades.)
(FERPA's treatment of student IDs depends on whether they are treated as personally identifiable information - in which case student IDs can not be disclosed in a way that allows student IDs to be matched to individual students - or whether they are treated as electronic identifiers, in which case they can be disclosed as "directory information" but may not be used to post grades. See this document for further details.)
In general, FERPA allows schools to put educational records in the "cloud", but places certain restrictions on how these records must be protected. Some "enterprise" or "education" versions of cloud services are FERPA-compliant (or can be made FERPA-compliant through special arrangement with the provider), and can be used to store educational records. A few "consumer"-grade cloud services are also FERPA compliant. Personal Dropbox accounts (not including Dropbox Business) are not, and should not be used to store FERPA-protected records, even as private Dropbox files that require authentication to view. See e.g. guidelines at UC Davis, University of Michigan, University of Oregon, University of Utah.