AWS S3 is the cloud's fundamental storage building block. But if misconfigured, critical data becomes open to the entire internet. We've heard plenty of "S3 bucket found open" headlines. In this article we'll focus on how to ensure security.
01. Closed by Default
Since 2018, AWS makes newly created buckets closed to public access by default. The "Block Public Access" setting should be on at the bucket level and the account level.
02. IAM and Bucket Policy
Access is controlled at two layers:
- IAM policy: user/role-based permission
- Bucket policy: the bucket's own rules
When the two conflict, the more restrictive one applies.
03. Encryption
For data at rest, SSE-S3, SSE-KMS or SSE-C. The most common is SSE-KMS: encryption with AWS's KMS keys. Key rotation can be set to automatic.
04. Versioning and Object Lock
Versioning: deleted files aren't really deleted, previous versions are preserved. Object Lock: a "WORM" (write once, read many) mode that prevents deletion for a set period.
05. Access Logs and GuardDuty
Logging of S3 access should be active. GuardDuty detects abnormal access patterns and alerts (for example, downloading 10,000 files at 3 a.m.).