Section 14: S3 Security Flashcards
SSE-S3 encryption type
AES-256
Advantage of using SSE-KMS
user control
audit key usage using cloudtrail
SSE-KMS limitation
KMS limits such as quota for decrypt KMS api calls
HTTPS must be used with this type of S3 encryption
SSE-C
This type of encryption uses keys managed outside of AWS by the customer
SSE-C
In CORS(Cross-Origin Resource Sharing) what parts make up the origin?
Scheme(protocol)
Host(domain)
Port
This is web browser security that allows you to enable objects being retrieved from one S3 bucket if request is coming from another origin
CORS
What must be enabled to use MFA delete
Versioning
Who can enable or disable MFA delete
The bucket owner(root account)
Two modes for S3 object lock
Compliance
Governance
What are the settings of compliance mode in S3 Object Lock
Object versions cannot be overwritten or deleted by an user
Object retention modes cannot be changed and periods cannot be shortened.
What are the settings of governance mode in S3 Object Lock
Most users cant overwrite or delete an object version or alter lock settings
Some users have special permissions to change retention or delete objects
This S3 Object Lock mode protects objects indefinitely
Legal Hold
