S3 Security

Question 1

Amazon S3
Security Types

Answer 1

• User-Based
• Resource-Based
• Encryption

Question 2

Amazon S3
User-Based Security Policy

Answer 2

• IAM Policies
• Which API calls are allowed for a specific IAM user

Question 2

Amazon S3
Resource Based Security Policy Types

Answer 2

• Bucket Policies
• Object Access Control List (ACL)
• Bucket Access Control List (ACL)

Question 3

Amazon S3
Bucket Policies

Answer 3

• Bucket wide rules from the S3 console
• Allows cross account access
• Make S3 bucket public
• Force encryption at upload
• Most common

Question 4

Amazon S3
Object Access Control List (ACL)

Answer 4

• Finer grain, can be disabled

Question 5

Amazon S3
Bucket Access Control List (ACL)

Answer 5

• Less common (can be disabled)

Question 6

An IAM principal can access an S3 object if

Answer 6

• Permissions OR resource policy ALLOWS it
• AND there is no explicit DENY

Question 7

Bucket settings for Block Public Access

Answer 7

• Create as an extra layer of security to prevent data leaks
• Leave on if bucket should never be public
• Can be set at account level

Question 8

S3 Encryption Types

Answer 8

• Server-Side Encryption (after upload, default)
• Client-Side Encryption (before upload)

Question 9

IAM Access Analyzer for S3

Answer 9

• Monitoring service
• Ensure only intended people have access to buckets
• Evaluates Bucket Policies, ACLs, & Access Point Policies
• Identify which buckets are public