Section 14: Amazon S3 Security Flashcards

Question

T/F and provide any true versions, if appropriate. Say Ive got an S3 bucket /somebucket and i've got some prefixes within that bucket s3://somebucket/finance s3://somebucket/sales I could: * A) Create an Access Point policy to grant R/W to /finance prefix * B) Create an Access Policy to grant R/W to /sales prefix * C) Would still need a regular bucket policy though, to grant R, W, or RW permissions to the entire bucket

Answer 1

C is false. Correct version is: * C) Create an Access Policy to grant R (read) permissions to the entire bucket. ## Footnote S3 Access points

Answer 2

It is missing THREE things! Muahahah! (or four, if you count commas). Correct version has * 1. open bracket around the value associated with keyword "Action", * 2. open bracket around the value associated with the keyword "Resource" * 3. A *second* item in the "Resource" value list, "arn:aws:s3:::us-west-2:1232435345345:accesspoint/example-vpc-ap/object/*" * 4. A comma between the first and second list items in the "Resource" value. Completed version looks like this: { "Version": "2012-10-17", "Statement": [ { "Principal": "*", "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::awsexamplebucket1/*", "arn:aws:s3:::us-west-2:1232435345345:accesspoint/example-vpc-ap/object/*" ] } ] } ## Footnote S3 Access Points

Answer 3

T ## Footnote S3 Object Lambda

Answer 4

T ## Footnote S3 Object Lambda

Answer 5

* That is with the analytics app, our S3 bucket gives info to our S3 Access Point which gives the info to our Lambda Function which redacts the PII info then gives the info (though it might be better to say that then the requested info is given back to, but you get the idea) our S3 Object Lambda Access Point (don't know why this has to be a different kind of access point that the regular S3 Access Point. Perhaps because it's only for one specific object (in this case, perhaps a redacted csv?)) * With the marketing app, data goes from our S3 bucket to AP1 to our enriching lambda function (though, again, don't get why it needs enriching twice, but I suppose I could come up with somehting) (also, to be clear, this is not the same lambda function as the one in the bullet above, though we are talking about the same S3 bucket and the same AP1), through our new S3 Object Lambda Access Point (that is, not the one described above), back to our marketing app. ## Footnote S3 Object Lambda

Answer 6

Correct answer and notes: B) SSE-C. With SSE-C, the encryption happens in AWS and you have full control over the encryption keys. Incorret answer notes. * A is incorrect. Notes: With SSE-S3, the encryption happens in AWS and you the encryption keys managed by AWS. Encryption keys stored in AWS. * B) is incorrect. Notes: With SSE-KMS, the encryption happens in AWS, and the encryption keys are managed by AWS but you have full control over the rotation policy of the encryption key. Encryption keys stored in AWS. * D) is incorrect. Notes: With Client-Side Encryption, you have to do the encryption yourself and you have full control over the encryption keys.

Answer 7

correct: B) notes. With SSE-KMS, the encryption happens in AWS, and the encryption keys are managed by AWS but you have full control over the rotation policy of the encryption key. Encryption keys stored in AWS. incorrect * A) is incorrect. Notes: With SSE-S3, the encryption happens in AWS and you don't manage the encryption keys. Encryption keys stored in AWS. * C) is incorrect. Notes: With SSE-C, the encryption happens in AWS and you have full control over the encryption keys. You could define a rotation policy but this is against the question requirements (encryption keys must be stored and managed by AWS). * D) is incorrect. Notes: With Client-Side Encryption, you have to do the encryption yourself and you have full control over the encryption keys. You could define a rotation policy but this is against the question requirements (encryption keys must be stored and managed by AWS).

Answer 8

Correct answer and notes: D) With Client-Side Encryption, you have to do the encryption yourself and you have full control over the encryption keys. You perform the encryption yourself and send the encrypted data to AWS. AWS does not know your encryption keys and cannot decrypt your data. Incorrect notes: * A) With SSE-S3, the encryption happens in AWS and you the encryption keys managed by AWS. Encryption keys stored in AWS. * B) With SSE-KMS, the encryption happens in AWS, and the encryption keys are managed by AWS but you have full control over the rotation policy of the encryption key. Encryption keys stored in AWS. * C) With SSE-C, the encryption happens in AWS and you have full control over the encryption keys.

Answer 9

Correct answer and notes: D) The cors one. notes: Cross-Origin Resource Sharing (CORS) defines a way for client web applications that are loaded in one domain to interact with resources in a different domain. To learn more about CORS, go here: https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html Incorrect answer notes: * A) If the S3 bucket policy is wrong, the files won't load in either case. * B) If the IAM policy was wrong, the files won't load in either case. * C) If the encryption was wrong, the files won't load in either case.

Answer 10

A) SSE-C (no notes) Incorrect: No incorrect answers have notes.

Answer 11

Correct answer note: C) Enable MFA delete. Note: MFA Delete forces users to use MFA codes before deleting S3 objects. It's an extra level of security to prevent accidental deletions. Incorrect answer notes: * A) bucket policy. notes: The bucket policy would prevent deletes altogether. no other answers have incorrect notes.

Answer 12

Correct answer notes B) Do nothing and let SSE-S3 handle it. It'll do it by default Notes: no notes. Incorrect answer notes: * A) Use a bucket policy that enforced HTTPS connect. Notes: This will force in-flight encryption but not at-rest encryption. no other incorrect answers have notes.

Answer 13

Correct answer: C) Use S3 Access Logs and analyze them using Athena. Notes: S3 Access Logs log all the requests made to S3 buckets and Amazon Athena can then be used to run serverless analytics on top of the log files. Incorrect answer: * A) Restrict their IAM policies and look at CloudTrail (cloudtail?) logs. Notes: This will be noticed by employees as they won't be able to access the files. * B) Use a bucket policy. Notes: A bucket policy would prevent access to the user but they would notice it.

Answer 14

Incorrect answers: * A) has no notes that weren't already made note of * B) S3 presigned URL. Note: S3 Pre-Signed URLs are temporary URLs that you generate to grant time-limited access to some actions in your S3 bucket. * C) S3 bucket policies. Notes: S3 Bucket Policies cannot help in giving temporary access to a dynamic list of federated users. * D) IAM Users. Notes: Federated users should not have IAM Users.