Stop 05 · Storage ServicesTopics · 7/9

Storage Security & Encryption

In short

'Bucket left open, lakhs of records exposed' is a headline you've probably seen. Storage security isn't hard, but it's layered. Miss one layer and everything else can't save you.

Encrypting data at rest (stored) and in transit (moving), and controlling access with fine-grained permissions — misconfigured public storage buckets remain one of the most common real-world cloud security incidents.

The blob character turns a key in a bank locker while holding a second key.

Think of it like this

The bank locker

A bank locker needs your key and the bank's key, you sign a register, and the vault is behind guarded doors. Even if someone sneaks in, the box is still locked. Cloud storage stacks the same kind of layers.

Watch it happen

Every check a GET passes

TLS

IAM

Policy

Block public

KMS decrypt

1/5The request arrives over HTTPS, so nobody on the network can read the data in transit.

The big ideas

What you need to know

Encryption at rest

S3 encrypts new objects by default. Use KMS keys when you need control over who can decrypt and an audit trail.

Encryption in transit

Always use HTTPS. A bucket policy can deny any request that doesn't use TLS.

Least privilege

Give apps access to only the buckets and prefixes they need, and only the actions they use.

Log access

Turn on CloudTrail data events or server access logs so you can see who read what, and when.

See it in code

Walk through the code

json

1{2  "Version": "2012-10-17",3  "Statement": [{4    "Sid": "DenyNonTLS",5    "Effect": "Deny",6    "Principal": "*",7    "Action": "s3:*",8    "Resource": [9      "arn:aws:s3:::college-records",10      "arn:aws:s3:::college-records/*"11    ],12    "Condition": { "Bool": { "aws:SecureTransport": "false" } }13  }]14}

1/3Deny every S3 action for everyone, but only when the condition below is true.

A bucket policy that refuses any request not made over HTTPS. Explicit Deny always wins over Allow.

Save yourself the pain

Common mistakes

Oops

Turning off Block Public Access to make one image load on a website.

Do this instead

Serve public files through a CDN with origin access control, and keep the bucket private.

Oops

Giving the app s3:* on every bucket.

Do this instead

Scope the policy to one bucket and prefix, and only Get or Put as needed. A leaked key then does far less harm.

Your mission

Lock down a bucket

~25 min

Quick check

An IAM policy allows s3:GetObject, but the bucket policy has an explicit Deny for the same request. What happens?

Go deeper

1Enable encryption at rest on a storage bucket or volume.
2Audit a hypothetical storage configuration for accidental public access.
3Learn why 'block all public access' should be the default, opted out of deliberately, not the exception.