Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [amazon-s3]

For questions about securing the data stored in Amazon's S3 storage service or Amazon Simple Storage Service, vulnerabilities associated with it, mitigating the risks, etc...

0
votes
1answer
108 views

How to disclose an open S3 bucket?

What is the most responsible way of disclosing an open AWS S3 bucket? Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
0
votes
0answers
12 views

Know the identity behind an AWS canonical ID [migrated]

Today while auditing a friends security settings, I found that an Amazon Folder (s3 bucket) with his most personal files had an unrecognised ACL entry. A person (with id ending in f6995f) had "Write" ...
2
votes
1answer
37 views

What attack vectors does AWS SSE-S3 help mitigate?

Reading into the various SSE options on S3, I'm can't understand the following: What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against? I can only think of ...
6
votes
1answer
455 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
0
votes
3answers
413 views

Monero being mined on our server

I noticed that recently our website has been performing poorly and often using 100% CPU usage on users machines. After looking into this I have noticed that all of the jquery files on our CDN were ...
0
votes
1answer
344 views

Risk of man in the middle attack on AWS S3 due to wildcard SSL certs

I see that using AWS S3 with https, it comes with a wildcard SSL cert. Does that mean man-in-the-middle attack is possible by DNS/network rogue and redirect users into another S3 link (having the ...
0
votes
1answer
132 views

Should I expose AWS Credentials on github?

Before you screen "No, never!", please read on :) Question: Is hard-coding IAM creds with extremely restricted permissions (only GET requests to s3) ok? I realize that there are other ways, but they ...
1
vote
0answers
77 views

What are the security implications of storing user-uploaded files on a third-party server versus your own managed webserver?

I'm working on a web platform which will contain some rather sensitive personal information, and obviously this raises the problem of how secure this data will be. Users can upload some files, and I ...
2
votes
1answer
104 views

Security of assets/media on s3

I got my application written in Flask (Python 3.6) and running on EB. I need to implement content editor which will allow to upload files on server and I would like to store them on s3. Most of ...
1
vote
1answer
809 views

Is it secure to have public access to the file on S3 with `secret` url? [duplicate]

For example https://s3-eu-west-2.amazonaws.com/mybucket/620f5cb4132cf1b4619503ece569599e This is a private file, I send to the web-browser through https link to that private file - but this file is ...
1
vote
2answers
286 views

File encryption design

I'm building an app and a server. The server is a node.js API with a Postgres backend. Images created in the app will be stored at Amazon S3. Metadata about the files will be stored in Postgres. I ...
1
vote
1answer
570 views

Do AWS and GAE use DMZ?

The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data. Now as an audit exercise this question is out to me: Are the ...
4
votes
1answer
4k views

Does Amazon S3 deletion “shred” your object

I believe Amazon states that all deletions of objects are irreversible. But for security reasons, how "shreded" is such deletion? For example, supposing a hack to Amazon S3, could anyone recover your ...
4
votes
2answers
298 views

Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?

Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options: Upload the image to our APIs server, then our APIs server uploads the image to S3 Pros: ...
2
votes
0answers
445 views

Does storing user files in S3 ensure that my server is secure from user uploaded malware?

Consider a common scenario where I'm using an Amazon S3 bucket to store the files uploaded by my users and not in my actual server. So, all the files the user uploads, go to the s3 bucket, and doesn't ...
2
votes
2answers
1k views

AWS S3 and 2-factor (multifactor)

I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it. I'd like to set up S3 to use 2-factor or MFA for the login/...
3
votes
1answer
329 views

Preventing millions of requests to Amazon s3 bucket [closed]

I developed an open source library and hosted its assets on Amazon S3 (CSS, JS), these files were used in demo via URLs like: http://my_bucket_name.s3.amazonaws.com/some-file.js (my bad, I know). ...
3
votes
1answer
2k views

Security of setting access to S3 bucket only from a particular website

I read about setting access to S3 bucket only from a particular website in Amazon Docs. And I quote : Suppose you have a website with domain name (www.example.com or example.com) with links to ...
0
votes
1answer
388 views

Does amazon take down availability zones or regions for maintenance? [closed]

If there are details available any where regarding their past outages or maintenance windows that took down their entire availability zone or regions please share
1
vote
1answer
235 views

Getting file from Amazon s3 encrypted based on user

I am storing my files on Amazon S3. My problem is that whenever a user asks for a file I want to generate an encryption key (user specific key) and encrypt the file and send it to him. So basically I ...
11
votes
3answers
10k views

What is the purpose of the expiration time in signed S3 urls?

S3 allows you to authenticate requests for media via a signed URL. This URL can include an expiration time, after which the URL is no longer valid (http://docs.aws.amazon.com/AmazonS3/latest/dev/...
1
vote
0answers
85 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
7
votes
1answer
1k views

What is legally required to store HIPAA data in the “cloud”?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would ...