Questions tagged [amazon-s3]

For questions about securing the data stored in Amazon's S3 storage service or Amazon Simple Storage Service, vulnerabilities associated with it, mitigating the risks, etc...

Filter by
Sorted by
Tagged with
1
vote
2answers
140 views

S3 Bucket Name Obscurity as Security

Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
1
vote
0answers
46 views

Storing user's private files on S3 and securing access using signed URLs - good idea?

I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information. I'm considering letting users directly access the files on S3, without ...
1
vote
1answer
59 views

AWS S3 resource access control through IAM permissions or bucket policies?

The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
0
votes
1answer
140 views

How to disclose an open S3 bucket?

What is the most responsible way of disclosing an open AWS S3 bucket? Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
2
votes
1answer
64 views

What attack vectors does AWS SSE-S3 help mitigate?

Reading into the various SSE options on S3, I'm can't understand the following: What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against? I can only think of ...
6
votes
1answer
467 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
0
votes
3answers
425 views

Monero being mined on our server

I noticed that recently our website has been performing poorly and often using 100% CPU usage on users machines. After looking into this I have noticed that all of the jquery files on our CDN were ...
0
votes
1answer
428 views

Risk of man in the middle attack on AWS S3 due to wildcard SSL certs

I see that using AWS S3 with https, it comes with a wildcard SSL cert. Does that mean man-in-the-middle attack is possible by DNS/network rogue and redirect users into another S3 link (having the ...
0
votes
1answer
139 views

Should I expose AWS Credentials on github?

Before you screen "No, never!", please read on :) Question: Is hard-coding IAM creds with extremely restricted permissions (only GET requests to s3) ok? I realize that there are other ways, but they ...
1
vote
0answers
80 views

What are the security implications of storing user-uploaded files on a third-party server versus your own managed webserver?

I'm working on a web platform which will contain some rather sensitive personal information, and obviously this raises the problem of how secure this data will be. Users can upload some files, and I ...
2
votes
1answer
112 views

Security of assets/media on s3

I got my application written in Flask (Python 3.6) and running on EB. I need to implement content editor which will allow to upload files on server and I would like to store them on s3. Most of ...
1
vote
1answer
927 views

Is it secure to have public access to the file on S3 with `secret` url? [duplicate]

For example https://s3-eu-west-2.amazonaws.com/mybucket/620f5cb4132cf1b4619503ece569599e This is a private file, I send to the web-browser through https link to that private file - but this file is ...
1
vote
2answers
315 views

File encryption design

I'm building an app and a server. The server is a node.js API with a Postgres backend. Images created in the app will be stored at Amazon S3. Metadata about the files will be stored in Postgres. I ...
1
vote
1answer
641 views

Do AWS and GAE use DMZ?

The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data. Now as an audit exercise this question is out to me: Are the ...
4
votes
1answer
5k views

Does Amazon S3 deletion “shred” your object

I believe Amazon states that all deletions of objects are irreversible. But for security reasons, how "shreded" is such deletion? For example, supposing a hack to Amazon S3, could anyone recover your ...
4
votes
2answers
362 views

Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?

Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options: Upload the image to our APIs server, then our APIs server uploads the image to S3 Pros: ...
2
votes
0answers
488 views

Does storing user files in S3 ensure that my server is secure from user uploaded malware?

Consider a common scenario where I'm using an Amazon S3 bucket to store the files uploaded by my users and not in my actual server. So, all the files the user uploads, go to the s3 bucket, and doesn't ...
4
votes
3answers
1k views

AWS S3 and 2-factor (multifactor)

I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it. I'd like to set up S3 to use 2-factor or MFA for the login/...
3
votes
1answer
390 views

Preventing millions of requests to Amazon s3 bucket [closed]

I developed an open source library and hosted its assets on Amazon S3 (CSS, JS), these files were used in demo via URLs like: http://my_bucket_name.s3.amazonaws.com/some-file.js (my bad, I know). ...
3
votes
1answer
2k views

Security of setting access to S3 bucket only from a particular website

I read about setting access to S3 bucket only from a particular website in Amazon Docs. And I quote : Suppose you have a website with domain name (www.example.com or example.com) with links to ...
0
votes
1answer
413 views

Does amazon take down availability zones or regions for maintenance? [closed]

If there are details available any where regarding their past outages or maintenance windows that took down their entire availability zone or regions please share
1
vote
1answer
286 views

Getting file from Amazon s3 encrypted based on user

I am storing my files on Amazon S3. My problem is that whenever a user asks for a file I want to generate an encryption key (user specific key) and encrypt the file and send it to him. So basically I ...
10
votes
3answers
11k views

What is the purpose of the expiration time in signed S3 urls?

S3 allows you to authenticate requests for media via a signed URL. This URL can include an expiration time, after which the URL is no longer valid (http://docs.aws.amazon.com/AmazonS3/latest/dev/...
1
vote
0answers
88 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
7
votes
1answer
1k views

What is legally required to store HIPAA data in the “cloud”?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would ...