S3 Security Flashcards
What are the 4 ways to encrypt objects in S3 buckets
- Server-Side Amazon S3 managed keys (SSE-S3)
- Server-Side KMS keys (SEE-KMS)
- Server-Side Customer provided keys (SSE-C)
- Client Side
What type of encryption does SSE-S3 used and what header must be set?
AES-256 - x-amz-server-side-encryption: AES-256
What are two advantages of using AWS KMS?
- Customer can create keys in KMS
- Key usage is logged in CloudTrail
What header must be set to use AWS KMS encryption?
x-amz-server-side-encryption: aws:kms
What is a limitation of SSE-KMS?
May encounter rate limits of KMS when making GenerateDataKey and Decrypt API calls
What protocol must be used when using SSE-C?
HTTPS
How could you enforce encryption in transit for S3?
Create an IAM policy that Deny’s requests based on the aws:secureTransport flag
What is the default encryption of S3
SSE-S3
How can you enforce encryption at rest for S3?
Create an IAM policy that Deny’s requests based on the s3:x-amz-server-side-encryption-customer-algorithm
What must you ensure if a client makes a cross-origin request onto an S3 bucket?
Ensure the clients origin is included in the AllowedOrigins of the S3 CORS configuration
What must be enabled in order to use MFA delete?
Versioning
Who can enable/disable MFA delete?
Bucket owner (root account)
What is a trap to avoid when enabling S3 logging buckets?
Dont set the logging bucket to the same bucket you are monitoring. This will create a loop!!
What’s the easiest way to log all access to S3 buckets?
Create a logging bucket which all logs from one bucket will be put into
What are the 3 different methods to generate S3 presigned URLS?
- S3 console
- AWS CLI/SDK
What permissions are applied to the person using an S3 presigned URL?
The permissions of the user who generated the URL
What is a good method to manage access to a shared bucket for multiple groups of users?
Define IAM policies and apply them to S3 access points
What must be created in order to access a S3 access point endpoint without leaving a VPC?
VPC endpoint that has an endpoint policy that allows access to the bucket and the access point
What must be created in order to run a lambda function when retrieving from S3?
S3 Object lambda access point -> Lambda function -> S3 access point
