Security

  • User Based
  • IAM policy determine, which API calls are allowed from console
  • Resource Based
  • Allow Cross Account
  • Object Access Control List (Object ACL) is finer grain
  • Bucket Access Control List (Bucket ACL) is less common
  • A IAM principal allow access S3 if
  • Any IAM permission allow
  • Any Resource Policy allow
  • No explicit deny in anywhere
  • Supports VPC Endpoint, do it is possible to interact with S3 without public internet
  • API Calls can be logged by Cloud Trail
  • S3 Access Logs can be stored in another S3 Bucket
  • User can use MFA to prevent unintended deletion
  • Presigned URL can be used for premium content
  • Presigned URL is generated by user credential token
  • It is valid for limited time

Bucket Policy

  • JSON Based Policy
  • Keys in the Policy
  • Effect means is the action Allowed or Denied
  • Principal means who is trying to access/taking-actions
    • It can be
    • User
    • Resource
  • Action means what type of action will be happen
    • Can be
    • READ Object
    • GET Object (single/multiple)
    • UPDATE Object
    • DELETE Object
  • Resource means on which Bucket or Object is targeted
  • Hands On Object can not be uploaded if it is not SSE-S3
  • Effect should be Deny
  • The Principal be *, since it is applicable for anyone
  • Service is AWS S3
  • Action be S3 Put Object
  • ARN should be s3://bucket_name/*
  • We have to deny if it does not match two condition
    • The header x-aws-server-side-encryption can not be null
    • The header x-aws-server-side-encryption is not equal AES-256

Bucket Settings for Block Public Access

  • Use to prevent company data leaks
  • We can block public access to a bucket through (No need to remember the names)
  • new ACL
  • any ACL
  • new Public Bucket
  • Access Point Policies

Allow cross account permission

To allow a bucket in production account from the development account,

  • On production account, create IAM role nd specify the development account as trusted entity
  • Create a policy that will allow the created role to access S3 bucket
  • In development account, using STS assume role create and attach the policy to the IAM user