Free AWS Security Whitepaper
    Toc Consulting Logo
    Glossary

    S3 Security

    Storage & Database

    S3 Security is critical because S3 buckets are one of the most common sources of AWS data breaches. Amazon S3 provides multiple layers of access control and data protection.

    Access Control

    • S3 Block Public Access: account-level and bucket-level settings that override any policy granting public access; should always be enabled
    • Bucket Policies: resource-based JSON policies for fine-grained access control
    • Access Points: named network endpoints with dedicated policies, simplifying access management for shared datasets
    • ACLs: legacy access control; AWS recommends disabling ACLs (bucket owner enforced)

    Data Protection

    • Server-Side Encryption: SSE-S3 (default since Jan 2023), SSE-KMS, or SSE-C
    • Object Lock: WORM (write-once-read-many) protection for compliance; governance or compliance mode
    • Versioning: protect against accidental deletion; combine with lifecycle rules
    • MFA Delete: require MFA to delete object versions or change versioning state

    Monitoring

    • S3 Access Logging: detailed records of requests made to a bucket
    • CloudTrail Data Events: API-level logging for S3 object operations
    • Macie: automatic discovery and classification of sensitive data (PII, PHI, financial)

    Related AWS Services

    S3KMSMACIE

    Related Content

    S3 Security CardAWS S3 Security GuideS3 Security: 22 ChecksPublic S3 Bucket Playbook

    Related Terms

    Bucket Policy

    A resource-based JSON policy attached to an S3 bucket that controls who can access the bucket and its objects, including cross-account and public access.

    Public Access

    When an AWS resource (S3 bucket, RDS instance, security group) is accessible from the internet, intentionally or accidentally, creating a potential security risk.

    Encryption at Rest

    Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.

    Server-Side Encryption (SSE)

    Encryption performed by AWS on data after it is received by the service, protecting it at rest without requiring client-side encryption logic.

    Fargate SecurityRDS Security

    Toc Consulting: AWS Security & Cloud Architecture

    Securing your AWS estate?

    Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.

    Book a discovery callhello@tocconsulting.fr