Questions tagged [amazon-s3]
For questions about securing the data stored in Amazon's S3 storage service or Amazon Simple Storage Service, vulnerabilities associated with it, mitigating the risks, etc...
54
questions
1
vote
0
answers
45
views
Prevention of access to user data running on the cloud
I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
- 129
0
votes
0
answers
28
views
Are unlisted links to sensitive data acceptable? [duplicate]
A third-party vendor that hosts our data is sending us links to an s3 amazon server to download reports of our data as a CSV. The endpoint does not check any permissions of the person trying to ...
2
votes
0
answers
29
views
AWS sub-accounts to protect against deletion of versioned data in S3
How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
- 135
0
votes
1
answer
224
views
After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?
I have a private S3 bucket. I want a user from an external organisation to have access.
I have added a user in IAM. How does this external user get notified and how do I share credentials?
The secret ...
- 651
0
votes
1
answer
102
views
Sharing a text file via Amazon S3 link with random words numbers [duplicate]
I would like to share a csv file to two or more separate computers/users. They would be running our software program which reads this text file. This is just initial idea for feedback please.
To make ...
- 101
0
votes
1
answer
791
views
How hard to hack are S3 Last-Modified timestamps?
Context: There are many reasons for wanting a very trustworthy timestamp on a document, as discussed in many other questions here such as this one I wrote in 2010. E.g., in an election auditing ...
- 20.7k
0
votes
0
answers
234
views
Risks of web crawlers on public buckets
So I have some data that isn't overly sensitive, but I'm still on the fence on whether or not we should invest the additional time into managing it as a private resource, vs just publicly available.
...
- 103
1
vote
2
answers
341
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
1
vote
2
answers
2k
views
Amazon AWS S3 Unrestricted File Upload
While I was pentesting a web application, I found out that files that are uploaded to the web application are stored in an AWS S3 instance. Based on my experience, when a web application needs to ...
- 143
0
votes
0
answers
198
views
Server Upload to presigned URL
I am writing a ReST service which enables user to get a tar archive of a set of requested documents. When the request succeeds, the service should upload the file to a pre-signed URL that points to an ...
- 101
1
vote
1
answer
213
views
Does adding a randomized string in S3 file path has equal security to Google Drive shared link
I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version.
I want that the firmware file in the S3 ...
- 385
0
votes
2
answers
382
views
No SSL between Cloudflare and S3 static site. A big security issue?
So I have a S3 static website. Domain, DNS and proxy is managed via Cloudflare. Cloudflare is set to communicate with browsers using SSL and it in fact enforces SSL for non-SSL requests. However, ...
- 101
0
votes
0
answers
367
views
DigitalOcean Spaces for personal backups
Sorry for the naive question.
I wonder how DigitalOcean Spaces (S3 compatible) fits personal backups.
I found a lot of information about security of Amazon S3 and its security is undoubted, however, ...
- 101
1
vote
0
answers
110
views
Is using randomized filenames a good way to secure data stored in a product like S3?
If I want to use a S3 clone to host something somewhat sensitive (probably digitalocean, since it's cheapest and probably has a perfectly good quality), is it sensible to do it this way:
https://...
- 225
1
vote
1
answer
818
views
Is the Amazon S3 Pre-Signed URL protected from brute force attack?
I want to know that whether Amazon S3 Pre-Signed URL is protected from brute force attack.
For example, if I am the only person who knows the Pre-signed URL, is it extremely unlikely that somebody use ...
2
votes
1
answer
124
views
How to handle AWS credentials
Our web application features a lot of media upload. We are making use of AWS S3 buckets for media storage. As per the current implementation, whenever a new file upload API is called, we send the AWS ...
- 1,452
0
votes
1
answer
274
views
Can't Amazon see my files if I use s3cmd/gpg with a complex password?
Since the early days of s3cmd I use it in combination with random generated filenames (uuidgen loop) and a complex passphrase (pwgen -n1 -c 32 -y). On security.stackexchange.com search there is only 1 ...
- 1,445
2
votes
3
answers
1k
views
Making S3 objects viewable only for logged in users
As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
- 21
0
votes
2
answers
2k
views
Are public website s3 buckets vulnerable to DDoS attacks?
We are trying to make our web app the most cost effective and secure we can.
For that reason we are using Cloudflare instead of CloudFront as a CDN for our frontend resources.
We put CloudFront ...
- 153
1
vote
2
answers
1k
views
Encrypt backup files and send them to AWS S3
I have a backup routine via crontab on Ubuntu.
This routine generates a compressed tar.gz file and sends it to AWS S3.
But I want to encrypt these files and be able to decrypt them when necessary on ...
- 174
1
vote
3
answers
460
views
Security considerations when naming S3 Buckets
What security considerations should be taken into account when naming an S3 bucket?
5
votes
3
answers
8k
views
How to make S3 Presigned url single use only?
Issue: I have a presigned url which is valid for 15 minutes. Upload can be initiated any number of times if the presigned url is captured in this time frame.
I want to make an S3 presigned url for ...
4
votes
1
answer
2k
views
Is it insecure to expose private bucket names through signed URL?
AWS provides signed url to objects in bucket.On backend we can connect with AWS and create such signed urls and send to front-endJust discussing this one use case where we use that signed url to make ...
6
votes
3
answers
3k
views
Is it more secure to encrypt separate customers' data with separate keys?
If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra ...
- 193
1
vote
1
answer
147
views
Encrypting file stores in s3
I am developing a system for storage of medical records. A person could upload image(s) or file(s). Since it is a medical record , it needs to be stored in encrypted form.Also I want that the files or ...
0
votes
1
answer
115
views
Is it safe to store user-uploaded ID scans in S3 (with server encryption)?
Currently my web app stores user-uploaded ID scans in S3. I am concerned about an eventual data leak.
The S3 bucket is encrypted with server-side encryption (AES-256) but I figure the next obvious ...
- 113
1
vote
1
answer
177
views
Amazon S3 policies: CORS or Service Accounts?
I have a question about accessing buckets on AWS S3. Let's suppose we have a bucket that has to have public read access by everyone and only my API has to be able to PUT and DELETE items from bucket. ...
- 69
0
votes
0
answers
63
views
Is Bucket Upload Policy a good pratice for upload files to AWS S3?
In AWS docs page has the following instructions to upload files to an AWS bucket from browser: https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
This solution send to browser a ...
- 69
0
votes
4
answers
5k
views
How do i scan my AWS S3 buckets for malicious content/objects?
I am setting up AWS SFTP which uses s3 to store files. I am setting up sftp to exchange files with third party organisations. When i receive files i want to ensure no malicious content is received. ...
- 651
1
vote
2
answers
103
views
Serverless Apps Authenticate Users After Page Load - Flaw?
Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
4
votes
2
answers
2k
views
S3 Bucket Name Obscurity as Security
Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. *
Can I assume that a public S3 ...
3
votes
0
answers
141
views
Storing user's private files on S3 and securing access using signed URLs - good idea?
I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information.
I'm considering letting users directly access the files on S3, without ...
- 131
3
votes
3
answers
568
views
AWS S3 resource access control through IAM permissions or bucket policies?
The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
- 1,522
0
votes
1
answer
385
views
How to disclose an open S3 bucket?
What is the most responsible way of disclosing an open AWS S3 bucket?
Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
2
votes
1
answer
252
views
What attack vectors does AWS SSE-S3 help mitigate?
Reading into the various SSE options on S3, I'm can't understand the following:
What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against?
I can only think of ...
- 143
6
votes
1
answer
611
views
Find Security Flaws in My Payment Page
I've done some extensive research about how to secure your website from card fraud.
iFrames do a pretty good job of this, however, It can still be worked around from certain exploits.
Many payment ...
0
votes
3
answers
511
views
Monero being mined on our server
I noticed that recently our website has been performing poorly and often using 100% CPU usage on users machines. After looking into this I have noticed that all of the jquery files on our CDN were ...
- 119
1
vote
1
answer
1k
views
Risk of man in the middle attack on AWS S3 due to wildcard SSL certs
I see that using AWS S3 with https, it comes with a wildcard SSL cert.
Does that mean man-in-the-middle attack is possible by DNS/network rogue and redirect users into another S3 link (having the ...
- 13
0
votes
1
answer
194
views
Should I expose AWS Credentials on github?
Before you screen "No, never!", please read on :)
Question:
Is hard-coding IAM creds with extremely restricted permissions (only GET requests to s3) ok? I realize that there are other ways, but they ...
- 171
1
vote
0
answers
190
views
What are the security implications of storing user-uploaded files on a third-party server versus your own managed webserver?
I'm working on a web platform which will contain some rather sensitive personal information, and obviously this raises the problem of how secure this data will be. Users can upload some files, and I ...
- 111
2
votes
1
answer
174
views
Security of assets/media on s3
I got my application written in Flask (Python 3.6) and running on EB.
I need to implement content editor which will allow to upload files on server and I would like to store them on s3. Most of ...
- 123
1
vote
1
answer
2k
views
Is it secure to have public access to the file on S3 with `secret` url? [duplicate]
For example https://s3-eu-west-2.amazonaws.com/mybucket/620f5cb4132cf1b4619503ece569599e
This is a private file, I send to the web-browser through https link to that private file - but this file is ...
- 117
2
votes
2
answers
461
views
File encryption design
I'm building an app and a server. The server is a node.js API with a Postgres backend.
Images created in the app will be stored at Amazon S3. Metadata about the files will be stored in Postgres.
I ...
- 177
1
vote
1
answer
1k
views
Do AWS and GAE use DMZ?
The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data.
Now as an audit exercise this question is out to me:
Are the ...
- 209
8
votes
1
answer
11k
views
Does Amazon S3 deletion "shred" your object
I believe Amazon states that all deletions of objects are irreversible. But for security reasons, how "shreded" is such deletion? For example, supposing a hack to Amazon S3, could anyone recover your ...
- 407
6
votes
3
answers
1k
views
Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?
Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options:
Upload the image to our APIs server, then our APIs server uploads the image to S3
Pros: ...
- 163
3
votes
0
answers
817
views
Does storing user files in S3 ensure that my server is secure from user uploaded malware?
Consider a common scenario where I'm using an Amazon S3 bucket to store the files uploaded by my users and not in my actual server. So, all the files the user uploads, go to the s3 bucket, and doesn't ...
- 129
4
votes
3
answers
3k
views
AWS S3 and 2-factor (multifactor)
I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it.
I'd like to set up S3 to use 2-factor or MFA for the login/...
- 1,209
5
votes
1
answer
707
views
Preventing millions of requests to Amazon s3 bucket [closed]
I developed an open source library and hosted its assets on Amazon S3 (CSS, JS), these files were used in demo via URLs like: http://my_bucket_name.s3.amazonaws.com/some-file.js (my bad, I know). ...
- 151
6
votes
1
answer
4k
views
Security of setting access to S3 bucket only from a particular website
I read about setting access to S3 bucket only from a particular website in Amazon Docs. And I quote :
Suppose you have a website with domain name (www.example.com or
example.com) with links to ...
- 163