{"id":2150,"date":"2021-03-07T12:31:28","date_gmt":"2021-03-07T05:31:28","guid":{"rendered":"https:\/\/vticloud.io\/?p=2150"},"modified":"2021-09-20T09:42:32","modified_gmt":"2021-09-20T02:42:32","slug":"cac-phuong-phap-tot-nhat-de-bao-mat-cho-dich-vu-amazon-s3","status":"publish","type":"post","link":"https:\/\/vticloud.io\/en\/cac-phuong-phap-tot-nhat-de-bao-mat-cho-dich-vu-amazon-s3\/","title":{"rendered":"Best security practices for securing Amazon S3"},"content":{"rendered":"

<\/p>\n

Amazon Simple Storage Service (Amazon S3)<\/strong> is one of the well-known services for storing data in the cloud of Amazon Web Services (AWS). The service is secured in accordance with AWS default policies, however, accidentally exposing data stored in buckets is easy to happen if you start changing existing default configurations or ignoring alerts.<\/p>\n

In the article below, VTI Cloud will take a few important steps to protect the data stored in the Amazon S3 service<\/span>.<\/strong><\/p>\n

Step 1: Name the S3 bucket (Bucket Naming)\u00a0<\/h2>\n

The first step in the security of Amazon S3 or often ignored by users is the naming of buckets.<\/strong><\/p>\n

On the Internet, you’ll easily find tools to scan and enumerate the names of publicly available buckets such as bucket-stream<\/a> and S3Scanner.<\/a> If you accidentally configure the public, the bucket of the organization will easily be “seen” by the above tools and the data in the bucket will likely leak.<\/p>\n

Bucket names are resolved by DNS so bucket names can be found on DNS logs or when public. AWS will provide a link where users can connect to S3 Bucket, such as tenbucket.s3.amazonaws.com.<\/strong> <\/em><\/p>\n

* Effective bucket naming\u00a0<\/h3>\n

VTI Cloud’s advice, as well as from the AWS side, is that the name of the bucket name in Amazon S3 should be unique and limited to coincide with any other bucket. This bucket name is only recognizable to you but does not give a clue who this bucket belongs to\/what organization it belongs to.<\/p>\n

\n

For example:<\/strong> When naming buckets that store highly secure data, you can name it data-1-abcdef<\/strong><\/em>. With ” data ” being the purpose of the data stored in the bucket,“1” to<\/strong> show that this data<\/strong>is only known to you or your team (which can be typed “2<\/strong>” with public data) and “abcdef<\/strong>” is a random phrase or number.<\/p>\n<\/blockquote>\n

You should limit the use of AWS Account ID in bucket names because they are vulnerable to revealing business information and identities.<\/p>\n

\"bucket<\/p>\n

Step 2: Set up log tracking and monitoring for Amazon S3<\/h2>\n

Requests to S3 buckets at the bucket level such <\/strong>as creating or deleting buckets<\/strong> can be tracked by the AWS CloudTrail service. Therefore, VTI Cloud encourages enabling AWS CloudTrail services and placing CloudTrail logs in a separate account (not related by other services and for read-only permission such as AWSCloudTrailReadOnlyAccess) <\/strong><\/em>for safety.<\/p>\n

\n

Learn more about AWS CloudTrail Identity-Based Policy: AWS CloudTrail Identity-Based Policy Examples – AWS CloudTrail (amazon.com)<\/a><\/span><\/p>\n<\/blockquote>\n

In addition to the actions at the bucket level above, VTI Cloud also encourages recording logs<\/strong> of actions inside buckets, e.g. PUT, GET, and DELETE actions, helping you track who or what accessed (or tried to access) your data.<\/p>\n

2.1. Log Monitoring for Amazon Simple Storage Service<\/h3>\n

There are 02 main ways to monitor logs in Amazon S3, including CloudTrail<\/a> object level logging and S3 server access logging.<\/a> VTI Cloud recommends activating at least one of these methods,<\/strong> using CloudTrail is the easiest option.<\/p>\n

CloudTrail logs record requests made to S3, IP addresses, request implementer, date stamp, <\/strong>and some other details.<\/strong><\/p>\n

\n

S3 server access logs provide newline-delimited logs that can contain additional details to help you investigate. Read more S3 server access log format at: Amazon S3 server access log format – Amazon Simple Storage Service<\/a><\/span><\/p>\n<\/blockquote>\n

\"s3<\/p>\n

2.2. Set up the accompanying alerts<\/h3>\n

Besides log monitoring, you should still set up some alarms with Amazon CloudWatch on Amazon CloudWatch metrics (Amazon CloudWatch request metrics for Amazon S3).<\/p>\n

\n

Read more: CloudWatch metrics configurations – Amazon Simple Storage Service<\/a>.<\/span><\/p>\n<\/blockquote>\n

For example, when the bucket is only used to store CloudTrail logs, there will be an alert every time the object is<\/strong> deleted (but PUT and GET requests to have a low threshold). This usually occurs when an attacker masks a trace in Amazon S3.<\/p>\n

In addition, depending on the support plan of your organization’s AWS account, you can use AWS Trusted Advisor’s Amazon S3 bucket permissions check<\/u> <\/a>to check open access permission.<\/p>\n

2.3. Using Amazon GuardDuty<\/h3>\n

Amazon GuardDuty<\/span><\/a> is a smart threat detection service that you should act to help detect threats and abnormalities and has Amazon S3 protection.<\/a><\/span><\/p>\n

This feature allows GuardDuty to monitor activities at the object level to identify potential security risks to data in S3 Buckets.<\/p>\n

If you have activated the Amazon GuardDuty service, <\/strong>go to the control panel (in each region you have activated) and verify that you have Amazon S3 protection enabled.<\/strong><\/p>\n

An example of architecture using Amazon GuardDuty with Amazon S3:<\/p>\n

\"s3<\/p>\n

2.4. Access Analyzer for S3<\/h3>\n

Access Analyzer for S3<\/span><\/a> informs you that S3 Buckets are configured to allow access by anyone on the internet or <\/strong>by other AWS accounts<\/strong> (both inside and outside the organization).<\/p>\n

\n

For example, access analyzer for S3 may show that a bucket has read or write permissions provided through bucket access control list (ACL),<\/em>bucket policy, or access point policy. Access Analyzer for S3 works by activating the IAM Access Analyzer<\/a> <\/span>first.<\/p>\n<\/blockquote>\n

Step 3: Encrypt data for Amazon S3<\/h2>\n

Encryption is considered an additional layer of security to control access to Amazon S3 data. Encryption will give deeper control over access to your bucket.<\/p>\n

There are many encryption options in Amazon S3, however, the easiest way to activate is also the easiest to use, and also very secure is the default server-side encryption using AWS Key Management Service.<\/a><\/span> The default encryption will be valid with all new and available buckets.<\/p>\n

\n

If you don’t use KMS default encryption, you must try to encrypt requests to objects in the bucket and have to set a bucket policy to reject uncoded requests.<\/p>\n<\/blockquote>\n

* Note when configuring AWS KMS<\/h3>\n
    \n
  1. \n

    When using the KMS key, pay attention to request quotas<\/a> per second, if less than 5000 requests \/ second, do not worry too much. Upon reaching the threshold, AWS KMS returns the ThrottlingException error as follows:<\/p>\n<\/li>\n<\/ol>\n

    \n

    You have exceeded the rate at which you may call KMS. Reduce the frequency of your calls.
    \n(Service: AWSKMS; Status Code: 400; Error Code: ThrottlingException; Request ID: <ID><\/span><\/em><\/p>\n<\/blockquote>\n

    2. Consider using different keys for data sensitivity levels, and each key’s access will have to be different.<\/p>\n

    \n

    For example, each KMS key will be used for different buckets in the same AWS account, the data and sensitivity level at each bucket are different.<\/p>\n<\/blockquote>\n

    3. Use the AWS Key Management Service Key (SSE-KMS)<\/strong> and select your own custom key to enabling default encryption:<\/p>\n

    \"server-side<\/p>\n

    Step 4: Access Control<\/h2>\n

    4.1. Prevent access to Amazon S3 from outside (Public)<\/h3>\n

    You can easily set up central controls to limit public access to S3 buckets regardless of whether they’re old or new buckets.<\/p>\n

    \n

    Buckets or “public” ACL objects only if members who are granted access are identified as users of the AllUsers <\/strong>group and the AuthenticatedUsers group.<\/strong><\/p>\n<\/blockquote>\n

    If a request is made from Amazon S3 Access Point<\/span>,<\/a> Amazon S3 checks whether public access prohibition policies apply to Access Point and will reject this request if it applies.<\/p>\n

    There are many different configurations for block public access, VTI Cloud recommends activating the whole (Block all public access).<\/strong> However, it is still necessary to check the logs of the buckets to avoid blocking requests from valid sources.<\/p>\n

    \"block<\/p>\n

    4.2. Access Control List (ACLs), AWS Identity and Access Management (IAM), and Bucket Policy<\/h3>\n

    ACLs are one of the basic ways to grant access to buckets. Resource-based ACL \u2013 in this case, S3 bucket \u2013 to manage access (as opposed to identity-based as users\/roles such as AWS Identity and Management). With AWS IAM, IAM policy will impact bucket levels and object levels.<\/p>\n

    When you create a bucket or an object, Amazon S3 creates a default ACL, granting resource owners full control over the resource. You can also attach S3 ACLs to each object in the bucket to manage access to those objects<\/p>\n

    ACL template grants access to Amazon S3 bucket<\/h4>\n

    <?xml version=\"1.0\" encoding=\"UTF-8\"?><\/code>
    \n<AccessControlPolicy xmlns=\"http:\/\/s3.amazonaws.com\/doc\/2006-03-01\/\"><\/code>
    \n\u00a0 <Owner><\/code>
    \n\u00a0 \u00a0 \u00a0<ID>Owner-canonical-user-ID<\/ID><\/code>
    \n\u00a0 \u00a0 \u00a0<DisplayName>display-name<\/DisplayName><\/code>
    \n\u00a0 <\/Owner><\/code>
    \n<AccessControlList><\/code>
    \n\u00a0 <Grant><\/code>
    \n\u00a0 \u00a0 \u00a0<Grantee xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xsi:type=\"CanonicalUser\"><\/code>
    \n\u00a0 \u00a0 \u00a0<ID>Owner-canonical-user-ID<\/ID><\/code>
    \n\u00a0 \u00a0 \u00a0<DisplayName>display-name<\/DisplayName><\/code>
    \n\u00a0 <\/Grantee><\/code>
    \n\u00a0 <Permission>FULL_CONTROL<\/Permission><\/code>
    \n<\/Grant><\/code><\/p>\n

    \u00a0 <Grant><\/code>
    \n\u00a0 \u00a0 \u00a0<Grantee xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xsi:type=\"CanonicalUser\"><\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0<ID>user1-canonical-user-ID<\/ID><\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0<DisplayName>display-name<\/DisplayName><\/code>
    \n\u00a0 \u00a0 \u00a0<\/Grantee><\/code>
    \n\u00a0 \u00a0 \u00a0<Permission>WRITE<\/Permission><\/code>
    \n\u00a0 <\/Grant><\/code><\/p>\n

    \u00a0 <Grant><\/code>
    \n\u00a0 \u00a0 \u00a0<Grantee xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xsi:type=\"CanonicalUser\"><\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0<ID>user2-canonical-user-ID<\/ID><\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0<DisplayName>display-name<\/DisplayName><\/code>
    \n\u00a0 \u00a0 \u00a0<\/Grantee><\/code>
    \n\u00a0 \u00a0 \u00a0<Permission>READ<\/Permission><\/code>
    \n\u00a0 <\/Grant><\/code><\/p>\n

    \u00a0 <Grant><\/code>
    \n\u00a0 \u00a0 \u00a0<Grantee xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xsi:type=\"Group\"><\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0<URI>http:\/\/acs.amazonaws.com\/groups\/global\/AllUsers<\/URI> <\/code>
    \n\u00a0 \u00a0 \u00a0<\/Grantee><\/code>
    \n\u00a0 \u00a0 \u00a0<Permission>READ<\/Permission><\/code>
    \n\u00a0 \u00a0<\/Grant><\/code><\/p>\n

    \u00a0 <Grant><\/code>
    \n\u00a0 \u00a0 \u00a0<Grantee xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xsi:type=\"Group\"><\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0<URI>http:\/\/acs.amazonaws.com\/groups\/s3\/LogDelivery<\/URI><\/code>
    \n\u00a0 \u00a0 \u00a0<\/Grantee><\/code>
    \n\u00a0 \u00a0 \u00a0<Permission>WRITE<\/Permission><\/code>
    \n\u00a0 <\/Grant><\/code><\/p>\n

    \u00a0 <\/AccessControlList><\/code>
    \n<\/AccessControlPolicy><\/code><\/p>\n

    However, to be simple in setting up access, you can use other methods. Include bucket policy if<\/strong> you want to grant permissions to another account or use IAM policy (SSO)<\/strong> if you need to grant access in an account or organization.<\/p>\n

    Template of S3 Bucket Policy<\/h4>\n

    {<\/code>
    \n\u00a0 \"Version\": \"2021-02-19\",<\/code>
    \n\u00a0 \"Statement\": [<\/code>
    \n\u00a0 \u00a0 \u00a0{<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0\"Effect\": \"Allow\",<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0\"Principal\": {<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0\"AWS\": [\"arn:aws:iam::111122223333:user\/Alice\",<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\"arn:aws:iam::111122223333:root\"]<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0},<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0\"Action\": \"s3:*\",<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0\"Resource\": [\"arn:aws:s3:::my_bucket\",<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"arn:aws:s3:::my_bucket\/*\"]<\/code>
    \n\u00a0 \u00a0 }<\/code>
    \n\u00a0 ]<\/code>
    \n}<\/code><\/p>\n

    This S3 Bucket Policy allows root account 111122223333 and IAM user Alice is allowed to perform actions on the S3 bucket (including internal data) named “my_bucket”.<\/p>\n

    \n

    Read more: Bucket policy examples – Amazon Simple Storage Service<\/a><\/span><\/p>\n<\/blockquote>\n

    Template of IAM Policy<\/h4>\n

    {<\/code>
    \n\u00a0 \"Version\": \"2021-02-19\",<\/code>
    \n\u00a0 \"Statement\":[{<\/code>
    \n\u00a0 \u00a0 \u00a0\"Effect\": \"Allow\",<\/code>
    \n\u00a0 \u00a0 \u00a0\"Action\": \"s3:*\",<\/code>
    \n\u00a0 \u00a0 \u00a0\"Resource\": [\"arn:aws:s3:::my_bucket\",<\/code>
    \n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"arn:aws:s3:::my_bucket\/*\"]<\/code>
    \n\u00a0 \u00a0 \u00a0}<\/code>
    \n\u00a0 ]<\/code>
    \n}<\/code><\/p>\n

    IAM policy grants the IAM (user, group, or role) that it is tied to permission to enforce actions on the S3 bucket (including internal data) named “my_bucket”.<\/p>\n

    \n

    IAM policy can limit access to each bucket and object prefix, can refer to the actions, resources and conditions of S3 in the following link:\u00a0 https:\/\/docs.aws.amazon.com\/service-authorization\/latest\/reference\/list_amazons3.html<\/a><\/span><\/p>\n<\/blockquote>\n

    4.3. MFA Delete<\/h3>\n

    Multi-factor authentication (MFA) Delete is a feature that adds an authentication layer to protect data and bucket from accidental deletion (versioning state of the bucket and permanent deletion of object version)<\/p>\n

    There are some notes when activating, only the root account (bucket owner) can enable the MFA Delete feature. In addition, to use MFA for versioning in the S3 bucket, you can only configure via AWS Command Line Interface (AWS CLI) or API (this API is used to configure versioning for buckets)<\/p>\n

    \n

    Amazon S3 stores the MFA Delete configuration in the same subresource versioning and is saved in bucket’s versioning status.<\/p>\n<\/blockquote>\n

    <VersioningConfiguration xmlns=\"http:\/\/s3.amazonaws.com\/doc\/2006-03-01\/\"> <\/code><\/p>\n

    \u00a0 <Status>VersioningState<\/Status><\/code><\/p>\n

    \u00a0 <MfaDelete>MfaDeleteState<\/MfaDelete><\/code>\u00a0<\/code><\/p>\n

    <\/VersioningConfiguration><\/code><\/p>\n

    Command to enable the MFA Delete for bucket versioning with AWS CLI:<\/p>\n

    $ aws s3api put-bucket-versioning --profile my-root-profile --bucket my-bucket-name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \u201carn:aws:iam::00000000:mfa\/root-account-mfa-device 123456\u201d<\/span><\/code><\/p>\n

    4.4. Access Points<\/h3>\n

    Access points<\/span><\/a> are network endpoints attached to buckets that are used to perform operations on S3 objects, such as GetObject and PutObject.<\/p>\n

    The access point is used to share data between accounts, instead of using bucket policy in section 4.3 above. Note that the access point only acts on objects in buckets.<\/p>\n

    VTI Cloud encourages the use of Access Point for the following jobs:<\/p>\n