- CheckMates
- :
- Products
- :
- CloudMates Products
- :
- CNAPP
- :
- How to Prevent S3 Buckets from Leaking Data - stri...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to Prevent S3 Buckets from Leaking Data - strictly follow these 7 simple rules
AWS S3 leaks have reappeared in headlines time and time again. When an AWS S3 bucket is configured as open to the public, anyone who finds the link can access the data without any additional hacking.
So, the question is, how can you avoid it?
As we know that all S3 leaks are related to misconfigurations, here are the rules:
- Block public access on the account level. These settings apply account-wide for all current and future buckets and access points. In case you need to allow public access to one or more buckets, override the setting on the specific bucket.
- Grant permission to your Amazon S3 resources trough IAM Policy, so only authenticate IAM users or IAM rules would be able to access the buckets.
- Use a bucket policy only if you can't achieve the same result with IAM Policy. It’s quite easy to mistakenly add a statement that publishes all the content publicly.
- Never use an S3 bucket ACL.
- Don't mix public data and private data in the same bucket.
- Name the bucket in a way that everyone will know whether it contains private or public data.
- Use Dome9 compliance rule sets and policy for running constant automatic checks against your buckets' configuration, to find non-compliant organization policy buckets.
Want to know more about how to write a Dome9 GSL query that checks if you have any buckets with public access? Check out our cloud security posture repository (CSPR) here
1 Reply
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is important to check your S3 bucket policy as well. If your IAM Policy does not have an explicit deny, a S3 bucket policy can have an allow that will override what would be a default deny.
![](/skins/images/BFDD56B372A07FDFABDEF003EE622D96/responsive_peak/images/icon_anonymous_message.png)