Skip to content

Latest commit

 

History

History
157 lines (148 loc) · 9.25 KB

5.3. Storage - S3 - Security.md

File metadata and controls

157 lines (148 loc) · 9.25 KB
Raw

S3 Security

  • Bucket owner = root account owning the e-mail address.
  • It supports Gateway VPC endpoints to be accessed in VPC without internet access
    • Gateway VPC Endpoint = an endpoint network interface (ENI)
  • Object / Bucket Permissions
    • User permissions: User ID has Read / Write access to Bucket / Object?
    • Public permissions: Public read access to bucket or not
    • System permissions: Grant Amazon S3 Log Delivery group write access to the group
  • MFA Delete
    • MFA (multi factor authentication) forces user to generate a code on device (mobile phone or hardware) before doing important operations on S3.
    • To use MFA-Delete, enable Versioning on the S3 bucket.
    • 💡 You will need MFA to
      • permanently delete an object version
      • suspend versioning on the bucket
    • 💡 Give only right users permissions for delete.
    • ❗ Only the bucket owner (root account) can enable/disable MFA-delete.
    • ❗ MFA-delete currently can only be enabled using the CLI
    • ❗ Affects only permanent deletes not delete markers
    • Flow: Create bucket with versioning -> Log-into root account -> Link to MFA Device (IAM -> Security Credentials) -> Generate root access keys -> Connect to CLI -> Set MFADelete=enabled with CLI command
  • S3 Pre-signed URLs
    • 📝 Allows granting access (URL) to one or more users for a certain amount and time and expire it.
      • URL can be used for GET (read) or PUT (upload).
      • Can generate pre-signed URLs using SDK (uploads as it's harder) or CLI
      • Valid for a default of 3600 seconds, can change timeout with --expires-in <time-by-seconds> argument
    • Users given a pre-signed URL inherit the permissions of the person who generated the URL for GET / PUT
    • E.g. premium video service for logged in users where they can view & list & upload temporarily.
    • Command: presign <S3URI> --expires-in <time-by-seconds> --region <region-of-object>
      • 💡 You can run aws configure set default.s3.signature_version s3v4 for making URL to be compatible with KMS encrypted object before signing

Logging and Auditing

  • Logging and Audit

    • CloudTrail

      • Logs bucket-level API calls
      • Logs S3 object-level API activity e.g. GetObject, DeleteObject, and PutObject API operations.
      • Also called CloudTrail Data Events

    • S3 access logs

      • Logs object-level API activity
      • Flow: Go to properties -> Turn on Server Access Logging -> Choose bucket

    • Access logs vs Object-Level CloudTrail logs

      Server Access Logging Object-Level Logging
      Complexity Low High
      Format Loosely-structured, space-delimited text records JSON
      Delivery Timeliness & delivery are not guaranteed API calls within 15 min are a captured and sent within 5 min
      Filtering No filtering Cloud Trail (basic), Cloud Watch (advanced, e.g. regex)
      Integrations S3 S3, CloudTrail, CloudWatch
      Costs S3 S3, CloudTrail, CloudWatch

    • ❗ Do not store your own access logs in the same bucket, otherwise; recursion

    • Data can be analyzed using data analysis tools

      • Also Amazon Athena and S3 Select can be used to query access logs

    • You can set prefixes for the logs

Policies

  • User based policies
    • IAM policies
    • which API calls should be allowed for specific user from IAM console
    • 💡 IAM policies instead of S3 bucket policies are in general more operationally efficient.
      • You need to control access to AWS services other than S3
        • Easier to manage everything from IAM instead of spreading
      • You have numerous S3 buckets each with different permissions requirements
        • Easier to manage with a few IAM policies instead of policy per bucket.
  • Resource based policies
    • 📝 Bucket policies
      • Allows cross account
      • JSON based policy (can be generated from Policy Generator)
        • Resources: buckets or objects
        • Actions: Set of API to Allow or Deny
        • Effect: Allow / Deny
        • Principal: The account or user to apply the policy to
      • 💡 Use-cases
        • 📝Force objects to be encrypted at upload
          1. Save statements in Bucket Policy:
            1. Create bucket policy -> Deny if any principal ( * ) uses action PutObject has condition header x-amz-server-side-encryption EqualsTo null is true.
            2. Create bucket policy -> Deny if any principal ( * ) uses action PutObject has condition header x-amz-server-side-encryption StringNotEquals AES256
          2. Set Default Encryption as Amazon S3 master-key to set the right header when uploading from console.
        • Grant access to another account (Cross Account)
        • Grant public access to the bucket
      • Syntax for including root and its endpoints
        • ❗ Careful: In policies if you use arn (amazon resource name) with only / e.g.it'll not apply policy to all endpoints under it you need to define it as with /*.
          • E.g. arn:awss3::::thebucketname/* instead of arn:awss3::::thebucketname/.
          • URL with /* will not include the root URL, if you need root as well use both / and /*.
    • Object Access Control List (ACL)
      • Access policy option to grant basic read/write permissions to other AWS accounts on object level.
        • E.g. account X can list objects, write objects, read bucket permissions, write bucket permissions
    • Bucket Access Control List (ACL): Less common
    • Glacier
      • Can have:
        • Single resource-based vault access policy
        • Single Vault Lock policy
          • For compliance e.g. can deny users permissions to delete an archive until the archive has existed for one year.
          • 💡 After the vault is locked it cannot be unlocked

Encryption

  • Encryption at rest

    • S3 Glacier encrypts your data at rest by default.

    • 4 methods of encrypting objects:

      1. SSE-S3 (Server Side Encryption - S3)
        • Encrypts S3 objects using keys handled & managed by AWS
        • Object is encrypted server side
        • AES-256
          • 📝 You must set header "x-amz-server-side-encryption":"AES256"
        • S3 provides S3 Managed Data Key as encryption key
          • Also called Amazon S3 master-key
        • Works with HTTP + HTTPS
      2. SSE-KMS (Server Side Encryption - Key Management Service)
        • Leverage AWS Key Management Service to manage encryption
        • KMS advantages: user control (over rotation of key) + audit trail (how the key was used)
        • Object is encrypted server side
        • 📝 Must set header "x-amz-server-side-encryption":"aws:kms"
        • KMS generates & uses CMK (Customer Master Key) as encryption key.
          • Also called AWS KMS master-key
          • You can select a key from KMS
        • Works with HTTP + HTTPS
        • 💡 Maintain control of the rotation policy for the encryption keys, but not know the encryption keys values
      3. SSE-C (Server Side Encryption - Customer)
        • When you want to fully manage your own encryption keys
        • ❗ HTTPS must be used (no HTTP)
        • Encryption key must be provided in HTTP headers for every HTTP request made
        • Uses client side data key
        • Amazon does the encryption & throws every key and returns data.
        • 💡 Recommended over client side encryption if you need to ensure that encryption is always used.
      4. Client Side Encryption
        • Client library such as Amazon S3 Encryption Client makes it easier.
        • Clients encrypt & decrypt data themselves
        • Clients fully manages the keys and the encryption cycle
        • Works with HTTP + HTTPS

    • Responsibilities

      Encryption type Who en/decrypts the data Who stores the secret Who manages the secret
      SSE-S3 AWS AWS AWS
      SSE-KMS (AWS managed CMK) AWS AWS AWS
      SSE-KMS (customer managed CMK) AWS AWS you
      SSE-C AWS you you
      AWS SDK + KMS (AWS managed CMK) you AWS AWS
      AWS SDK + KMS (customer managed KMS) you AWS you
      AWS SDK + self-managed secret you you you

    • SDK

      • AWS SDK supports for Amazon S3 Client-Side Encryption
      • AWS Encryption SDK is an encryption library that is separate from the language–specific SDKs.
      • Difference between AWS SDK (in language-specific AWS SDKs) vs Encryption SDK
        • Encryption SDK is not tied to Amazon S3 and can be used to encrypt or decrypt data to be stored anywhere.
        • Good for enforcing best practices in organization.
  • Encryption in transit (SSL)
    • 📝Achieved by SSL/TLS
    • S3 exposes HTTP and HTTPS URL, HTTP has encryption in flight.
  • Default Encryption
    • Encryption is per object level, but you might want to enforce encryption of all objects.
    • Old way: Use a bucket policy and refuse any HTTP command without the proper headers
    • New way: Enable Default Encryption setting on S3 by ticking.
      • Bucket policies are evaluated before default encryption
      • You can choose between SSE-S3 (AES-256) or SSE-KMS (AWS-KMS)