Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Architect Associate > Amazon S3 Security > Flashcards

Amazon S3 Security Flashcards

1
Q

How many methods of encryption are there for S3?

A

4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Sever-Side encryption with Amazon S3-Managed Keys (SSE-S3) - Default

A

encrypts objects using keys handled, managed, and owned by AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Server-Side Encryption with KMS keys stored in AWS KMS (SSE-KMS)

A

Leverage AWS Key Management Service (AWS KMS) to manage encryption keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Server-Side Encryption with Customer-Provided Keys (SSE-C)

A

When you want to manage your own encryption keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Client Side Encryption

A

This happens on the client server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does S3 Encryption - SSE S3 work

A

Encryption using keys handled, managed, owned by AWS

Server side encryption

Type is AES 256

header must include “x-amz-server-side-encryption”:”AES256”

enabled by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Amazon S3 Encryption - SSE-S3 architecture

A

User uploads HTTP(S) + Header to Amazon S3.

The object is paired with S3 Owned Key, and is encrypted moving to the encrypted S3 Bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Advantages of SSE-KMS?

A

keys are handled by AWS KMS

there is user control & audit key usage using CloudTrail (logs everything that happens)

Object is encrypted server side

header = x-amz-server-side-encryption”:”awsLkms”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SSE-KMS encryption architecture

A

User uploads HTTP(S) & KMS header into Amazon S3.

Object is created and is combined with KMS key from AWS KMS. Then it gets encrypted and moved to the S3 Bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SSE-KMS Limitations

A

When you uplaod it calls GenerateDataKey KMS API.

When downloading it calls Decrypt KMS API.

This means that you are quoted and charged for each call.

Can result in throttling use case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SSE-KMS API calls architecture

A

User upload/download SEE-KMS.

S3 Bucket calls API KMS Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SSE-C encryption

A

Server-Side encryption using keys managed by customer outside AWS.

Amazon S3 does NOT store keys you provide

MUST use HTTPS

Encryption key must provide in HTTP headers for every HTTP request made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SSE-C architecture

A

User uploads file and key (HTTP ONLY & Key in header).

Amazon S3 uses Client-provided key and object, encrypts it and then moves it to S3 bucket.

To read it you need the key provided.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

S3 Client-Side Encryption

A

use client libraries such as Amazon S3 Client-Side Encryption Library

clients must encrypt data before sending to S3

also must decrypt data when retrieving from S3

Customer fully manages keys and encryption cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Client-Side Encryption Architecture

A

File & Client key are encrypted. Then the encrypted file is uploaded via HTTP(S) to Amazon S3 Bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Encryption in Transit (SSL/TLS)

A

HTTPS recommended when using amazon S3

And HTTPS mandatory for SSE-C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do you force encryption in transit? aws:SecureTransport

A

Add Bucket Policy onto S3 Bucket that says “aws:SecureTransport”: “false”

Blocks all HTTP traffic and allows only HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Default Encryption vs Bucket Policies

A

SSE-S3 is automatically applied to new objects

You can also Force encryption using bucket policies and refuse any API call to PUT an S3 object without encryption headers (SSE-KMS or SSE-C)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Are Bucket Policies evaluated before “Default Encryption”?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does CORS mean?

A

Cross-Origin Resource Sharing (CORS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Origin in CORS?

A

scheme (protocol) + host (domain) + port

e.g. https://www.example.com = port is 443 for HTTPS, 80 for HTTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is CORS? technical

A

Web Browser based mechanism to allow requests to other origins while visiting the main origin

same origin = http://example.com/app1

&

http://example.com/app2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Give an example of same origin CORS

A

same origin = http://example.com/app1

&

http://example.com/app2

24
Q

Give an example of different origin CORS

A

http://www.example.com

&

http://other.example.com

25
Q

What happens if you do not use CORS Headers?

A

The requests won’t be fulfilled unless the other origin allows for the requests.

e.g. Access-Control-Allow-Origin

26
Q

CORS Architecture

A

Web server (origin) https://www.example.com

Web Browser

Web Server (Cross-Origin) https://www.other.com

Web browser requests via HTTPS information on origin web server. The Origin Web server tells the web browser they can have this information but the other information is on the cross origin server.

The web browser sends preflight request to cross-origin server saying I want this information, you are the host, and this is the origin server.

Cross-origin server says, origin server is allowed to use methods GET, PUT, DELETE in a preflight response.

Then the Web Server will make a request to the Cross Origin server and make these calls.

27
Q

How does CORS apply to S3?

A

If client makes cross-origin request on our S3 bucket, we need to enable correct CORS headers.

28
Q

What can you do with origins in CORS?

A

Can allow for specific origin or * all origins

29
Q

CORS on S3 architecture

A

Web browser sends GET/index.html request to host bucket.

Host bucket sends index.html to web browser.

In that index.html there is an image called coffee.jpg which is hosted on the other S3 bucket.

To use that, the web browser makes a GET/images/coffee.jpg request to the other bucket saying, you are the target host of this image, and the origin for the request is the other S3 bucket.

If CORS headers are configured correctly, then the second S3 bucket will do an Access-Control-Allow-Origin and allow the Web Browser to retrieve the coffee.jpg image and display it.

30
Q

What is MFA Delete?

A

When you need to delete an object version permanently or suspend versioning on the bucket you will be asked for an MFA code

31
Q

What do you need to have to use MFA delete?

A

Bucket Versioning must be enabled

32
Q

Who can enable/disable MFA delete?

A

Only the root account (bucket owner)

33
Q

S3 Access Logs

A

Any request from any acc, auth or denied, gets logged into another S3 bucket

34
Q

What can you do with S3 logs?

A

analyse them with tools such as athena

35
Q

Where does the target logging bucket must be?

A

same AWS region

36
Q

What should you never do with S3 logs?

A

Do not set your logging bucket to be the monitored bucket.

if you do you will create a logging loop

37
Q

Pre Signed URLs

A

Generate pre-signed urls using S3 Console, AWS CLI or SDK

38
Q

URL expiration

A

S3 console = 1 - 720 mins (12 hours)
AWS CLI - 3600 604800 sec (168 hours)

39
Q

What is the purpose of a pre-signed url?

A

Users given a pre-signed URL inherit the permissions of the user that generated the URL for GET /PUT

40
Q

Pre-Signed URL use case (architecture)

A

You have a private S3 bucket and want to share a file within that bucket.

You generate pre-signed URL, send that URL to the user, and they can use that URL to download only that specific file

41
Q

S3 Glacier Vault Lock

A

Adopt a WORM (Write Once Read Many) model

42
Q

How do you create S3 Glacier Vault Lock?

A

Create a Vault Lock Policy

43
Q

What happens if you lock the policy for future edits?

A

Can no longer be changed or deleted

44
Q

When is a Glacier Vault Lock helpful?

A

For compliance and data retention

45
Q

S3 Object Lock (different than S3 Glacier Vault Lock)

A

WORM (Write Once Read Many) model

Blocks an object version deletion for a specified amount of time

46
Q

What is Retention Mode Compliance in S3 Object Lock?

A

object versions cannot be overwritten or deleted by any user, including root user

object retention modes cant be changed and retention periods cant be shortened

47
Q

What is Retention Mode Governance in S3 Object Lock?

A

most users cant overwrite or delete an obj version or alter its lock settings

some users have special permissions to change the retention or delete the object

48
Q

What is a retention period

A

protect the object for a fixed period, it can be extended

49
Q

What is Legal Hold

A

protect the object indefinitely, independent of retention period

can be freely placed and removed using S3:PutObjectLegalHold IAM permission

50
Q

S3 Access Points

A

Create access points for each S3 location and assign a Policy for Read/Write to it. Then connect the group of users you want to use that access point.

For example Finance users will access that access point and only be able to read/write in the S3 bucket /finance folder.

51
Q

Why do we need access points?

A

To simplify security management for S3 Buckets

52
Q

What do each access point have?

A

Its own DNS (Internet Origin or VPC origin)

53
Q

Access point policy

A

similar to bucket policy - manage security at scale

54
Q

Access Points within VPC Origin

A

EC2 instances talks to VPC endpoint (has an endpoint policy) and outside the VPC there is an access point VPC Origin with an access point policy attached. Then that talks to the S3 bucket which also has a bucket policy

Basically define access point to be accessible only from within the VPC

55
Q

What do you need to create to have access the Access the Access point (gateway or interface endpoint) within a VPC?

A

VPC Endpoint

56
Q

What does the VPC endpoint policy must do to have access to the target bucket and access point?

A

Policy must be set to allow

57
Q

S3 Object Lambda

A

Write code and invoke Lambda to change an object after it was taken from the bucket and before the caller application receives it

AWS Architect Associate (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions