Skip to main content
Share Your Experience: Take the 2024 Developer Survey
8 votes
Accepted

Is it insecure to expose private bucket names through signed URL?

tl/dr: As long as the bucket is not publicly accessible (i.e. you need access keys to read/write), then don't worry about the name. It isn't private because your employees probably know it and ...
Conor Mancone's user avatar
7 votes
Accepted

Does Amazon S3 deletion "shred" your object

Part of the answer depends on which region your data is stored in and if there are any government restrictions that may require them to retain data for any given time period. https://aws.amazon.com/...
Trey Blalock's user avatar
  • 14.2k
6 votes

Find Security Flaws in My Payment Page

Stored in .html (Ensure nothing can be injected by the DB or exploitable server-side scripts, such as PHP). For this I would break everything down into modular components and work from there: Harden ...
safesploit's user avatar
  • 1,867
6 votes
Accepted

Security of setting access to S3 bucket only from a particular website

Your intuition is correct in the most important way -- this is not, in any meaningful sense, "secure." But the way it's defeated is not quite what you envision. When you click a link on a web page, ...
Michael - sqlbot's user avatar
5 votes
Accepted

Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?

The preferred way to go is to generate a presigned POST request (your backend server asks for it with your own admin credentials). Then from client-side you upload using this pre-signed POST. It's ...
Qortex's user avatar
  • 341
4 votes

Monero being mined on our server

The Java-Script https://www.jqr-cdn.download/jquery-3.3.1.js is loaded. If you format it, it looks like this: https://pastebin.com/D9087NvS Then the function startMining is called. function ...
trietend's user avatar
  • 864
4 votes

AWS S3 and 2-factor (multifactor)

MFA is not designed to prevent any file deletion or change. It's only goal is to make stealing user's credentials much more difficult. Also, you don't setup MFA for S3 bucket (or object), you setup ...
Sergey Kovalev's user avatar
4 votes

S3 Bucket Name Obscurity as Security

Bottom line, the answer is No. If your S3 bucket is public, and you make it a website, the bucket name will appear in certificate logs which are fully public. There are tools that sniff certificate ...
keithRozario's user avatar
  • 3,711
4 votes

Is it more secure to encrypt separate customers' data with separate keys?

One argument in favour of separate keys: assume at some point in the future your app has some sort of SQLInjection or Server-side request forgery (SSRF) vulnerability that lets a user logged in as ...
Mike Ounsworth's user avatar
4 votes
Accepted

Is it more secure to encrypt separate customers' data with separate keys?

Unfortunately, the answer is "It depends". But first, we need to clear up that KMS keys and Buckets are mutually independent, one KMS key (called a CMK) can be tied to multiple buckets, and one ...
keithRozario's user avatar
  • 3,711
3 votes
Accepted

S3 Bucket Name Obscurity as Security

First, standard disclaimer: Security is not an all or nothing proposition. Security procedures for an anonymous favorite-cat-voting website will not be as stringent as the security procedures for the ...
Conor Mancone's user avatar
3 votes

How to disclose an open S3 bucket?

The AWS documentation has a vulnerability reporting section. While what you are describing is not a vulnerability in the S3 infrastructure, I would be genuinely surprised if this was not still an ...
Michael - sqlbot's user avatar
3 votes
Accepted

What attack vectors does AWS SSE-S3 help mitigate?

A number of regulated industries require Encryption at Rest to be compliant with relevant standards (PCI-DSS, HIPPA, etc), so this is providing this tick box. The attack vectors that this is ...
David Waters's user avatar
  • 2,801
3 votes

AWS S3 and 2-factor (multifactor)

This is now possible with AWS S3. The following policy allows users from account one, two and three to put and delete objects with MFA. { "Version": "2012-10-17", "Statement": [{ "Effect": "...
Upul Doluweera's user avatar
3 votes

AWS S3 and 2-factor (multifactor)

Can I set up S3 to use some kind of 2 factor authentication? No, because S3 doesn't have authentication of its own. Does the Access ID count for 2 factor since it is random and not tied to a ...
Xiong Chiamiov's user avatar
3 votes
Accepted

Monero being mined on our server

First of all: your server has been compromised. The attacker have the means of changing the file on the website, copying any file. He very probably have access to any databases too - if the site have ...
ThoriumBR's user avatar
  • 54.4k
3 votes

Security considerations when naming S3 Buckets

If you embed a bucket name into an application (of any sort), and subsequently you delete that bucket, then someone else might create a bucket with the same name and now effectively have a way to ...
efitz's user avatar
  • 31
3 votes
Accepted

Are public website s3 buckets vulnerable to DDoS attacks?

If you're concerned with massive data transfer costs on CloudFront, you would still be vulnerable as CloudFlare can just be circumvented. You'd need to pay for AWS WAF for protecting your CloudFront ...
F Nakandakari's user avatar
3 votes
Accepted

How to handle AWS credentials

There are at least two ways to achive this: using presigned URLs (see also here) generating a temporary, signed policy allowing actions on the bucket In either case you need to make sure to only ...
tim's user avatar
  • 29.6k
3 votes

No SSL between Cloudflare and S3 static site. A big security issue?

Attackers with limited reach like lokal HotSpots or smaller ISP level will not be able to read the data. The traffic they have access to is between the client and Cloudflare and thus protected by SSL. ...
Steffen Ullrich's user avatar
2 votes
Accepted

File encryption design

Just to summary the discussion: you need to know what kind of attacks you want to protect keys against. As we discussed you correctly mentioned pros and cons of both solutions. I recommended to mix ...
Fis's user avatar
  • 1,230
2 votes
Accepted

Security of assets/media on s3

Facebook does something similar to the "presigned URL" - their image CDN doesn't check for authentication, nor is it on the same domain so it can't even get the Facebook session cookie if it wanted to ...
André Borie's user avatar
  • 12.8k
2 votes

Monero being mined on our server

Starting with your Last question: The Phrase: "winner winner chicken dinner" Stands for a CPU miner for Litecoin and Bitcoin (mostly Bitcoin). Which means: This JQuery miner uses Websockets ...
Pawel Kostelnik's user avatar
2 votes

AWS S3 resource access control through IAM permissions or bucket policies?

I know it isn't the answer to your question -- but I think having a completely separate bucket for the publicly accessible items makes more sense than trying to limit a single folder within the bucket....
keithRozario's user avatar
  • 3,711
2 votes

AWS S3 resource access control through IAM permissions or bucket policies?

Restrict access to your S3 buckets or objects by: Writing AWS Identity and Access Management (IAM) user policies that specify the users that can access specific buckets and objects. IAM policies ...
Exequiel Barrirero's user avatar
2 votes

How do i scan my AWS S3 buckets for malicious content/objects?

you can try the approach of using ClamAV which is an open-source AV. https://github.com/upsidetravel/bucket-antivirus-function Also Second approach if you can use the Virustotal enterprise API for ...
antimatter_xyclops's user avatar
2 votes
Accepted

Encrypting file stores in s3

Word of advice: It's great that you are reaching out, but medical data is particularly sensitive and handling should be done by an experienced developer and the code should be peer reviewed. There ...
phisch's user avatar
  • 1,315
2 votes

How to make S3 Presigned url single use only?

Solution #1 is viable but only if the source bucket is versioned and the Lambda function writes to a database that supports strongly consistent reads, because that's the only way you can tell ...
Michael - sqlbot's user avatar
2 votes

Encrypt backup files and send them to AWS S3

Check out s3cmd. There is an option to encrypt files on the client side (using keys that are managed on the client side), then copy or sync the encrypted files to s3 buckets.
mti2935's user avatar
  • 23.6k
1 vote
Accepted

Is it safe to store user-uploaded ID scans in S3 (with server encryption)?

The common way to store these more sensitive documents is to encrypt them with KMS. Unlike the AES-256 encryption (which AWS themselves claim to be slightly legacy), KMS encryption requires a ...
keithRozario's user avatar
  • 3,711

Only top scored, non community-wiki answers of a minimum length are eligible