Monthly Archives: August 2021

Securing Your Data on AWS S3

Leave a reply

If you store critical and sensitive data on the cloud, particularly on AWS S3 object storage, it is important that you continually protect and monitor your data. Fortunately, AWS has a lot of tools to help you secure them. AWS built their services with security in mind. However, it is still your responsibility as a data owner to protect your data.

Here are the top ten best practices for securing your data on AWS S3:

  1. Ensure that your S3 buckets are not publicly accessible by using Amazon S3 block public access.
  2. Ensure that your S3 buckets have the correct policies. Use Amazon S3 bucket policy and IAM user policy, as well as the bucket access control list (ACL) to implement effective permissions on the buckets. Make sure to implement least privilege access, granting only minimal rights for users to get their jobs done.
  3. Encrypt data at rest on the server side using Amazon S3 managed keys (SSE-S3), customer master keys stored in AWS Key Management Service (SSE-KMS), or customer-provided keys (SSE-C). You can also encrypt your data on the client side before uploading to AWS S3.
  4. Encrypt data in transit using HTTPS (TLS). You can enforce this by setting it in the Amazon S3 bucket policies.
  5. Enable and require VPC endpoints for AWS S3 access. A VPC endpoint can help prevent traffic from potentially traversing the open internet and being subject to the open internet environment.
  6. Enable versioning to keep multiple versions of a file in the same bucket. With versioning, you can easily recover files from both unintended user actions and application failures.
  7. Use cross-region replication (CRR) to replicate your data to a different AWS region, thereby increasing data resiliency.
  8. Enable multi factor authentication (MFA) Delete and S3 Object Lock feature to prevent malicious or accidental bucket deletions.
  9. Continually monitor and audit your S3 buckets by using AWS tools such as Cloudwatch, Cloudtrail, S3 access logging, and AWS Config.
  10. Use AWS Access Analyzer for S3 to quickly analyze resource policies, continuously monitor and analyze permissions, and resolve findings by updating policies.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html