S3 Storage & Security

Simple Storage Service (S3)

Amazon S3 (Simple Storage Service) 101

Amazon S3 – Core Concepts
S3 Objects
S3 Buckets

S3 Security (Bucket Policies & ACLs)

Providing Access to S3
S3 Bucket Policies

When to Use Identity vs Resource Policies

S3 Access Control Lists (ACLs)
S3 Block Public Access Setting

S3 Static Website Hosting & Billing

S3 Static HTTP Website Hosting
S3 Static Website Hosting – Use Cases
  1. Content Offloading
    • Move large static files (e.g., images, videos) from compute services to S3
    • Reduces load on services like EC2 and lowers costs
    • Example: store images in S3 and return their URLs from an application
  2. Out-of-Band Failover Pages
    • Host backup or maintenance pages separately from the main application
    • Ensures availability even if the primary compute service fails
    • Example: redirect traffic to an S3-hosted status page during downtime
  3. Static Website Hosting
    • Ideal for simple, non-dynamic websites such as blogs or portfolio pages
S3 Billing

S3 Object Versioning & MFA Delete

S3 Object Versioning
S3 Operations With and Without Versioning
S3 Object Versioning → // S3 Operation ↓DISABLEDENABLEDSUSPENDED
Standard GETReturns the objectReturns the most recent versionReturns the most recent version
Version GETNot supportedRetrieves the specified versionRetrieves the specified version
Standard PUT (update object)Replaces the existing objectCreates a new version and marks it as currentReplaces the current version
Standard DELETEPermanently removes the objectAdds a delete marker, older versions remainAdds a delete marker, older versions remain
Version DELETENot supportedDeletes a specific versionDeletes a specific version
MFA Delete

S3 Performance Optimization

Default S3 Single-Stream Uploads
S3 Multipart Upload
S3 Transfer Acceleration

Encryption 101

Encryption – Key Concepts
Encryption Approaches

Encryption at Rest

Encryption in Transit

Encryption Types

Symmetric Encryption

Asymmetric Encryption and PKI

Digital Signing
Steganography

Envelope Encryption

Envelope Encryption – Key Concepts
Envelope Encryption – Encrypt/Decrypt Processes

Scenario: Many cat pictures are stored in Amazon S3, and we want to encrypt them securely using AWS KMS.

Encryption Process

  1. Customer creates a KMS key for use with S3
  2. S3 requests KMS to generate a DEK for a cat picture
  3. KMS generates a DEK and returns:
    • Plaintext DEK → used immediately by S3 to encrypt data
    • Wrapped DEK (ciphertext version) → stored alongside encrypted object
  4. S3 encrypts the cat picture using the plaintext DEK, then discards the plaintext DEK
  5. Encrypted cat picture and wrapped DEK are stored together
  6. Repeat for all pictures

Why envelope encryption?

Decryption Process

  1. Customer requests access to an encrypted cat picture
    • If the customer lacks KMS permissions, S3 cannot decrypt the object
  2. S3 sends the wrapped DEK to KMS to unwrap (decrypt) it
  3. KMS verifies permissions and identifies which KMS key (KEK) was used
  4. KMS decrypts the DEK and returns the plaintext DEK to S3
  5. S3 decrypts the cat picture using the plaintext DEK, then discards the DEK
  6. S3 returns the decrypted cat picture to the customer

This approach ensures security, efficiency, and granular access control.

AWS Key Management Service (KMS)

AWS KMS – Overview & Key Concepts

What KMS Does

Security & Isolation

Cryptographic Operations
OperationDescription
CreateKeyCreates a KMS key and stores it encrypted in HSMs
EncryptEncrypts plaintext using a KMS key → returns ciphertext
DecryptDecrypts ciphertext → returns plaintext (KMS key info embedded in ciphertext)
GenerateDataKeyGenerates a Data Encryption Key (DEK) for bulk encryption (>4 KB)

KMS permissions are very granular → allows strict role separation

KMS Keys

Types of KMS keys

  1. AWS-owned (default, free)
    • Used automatically by AWS services (S3, SQS, DynamoDB)
    • Shared across accounts → low admin overhead, but limited security controls
  2. Customer-owned
    • AWS-managed (free) → AWS creates/manages, rotates automatically yearly
    • Customer-managed ($1/month) → customer creates and manages manually
      • Supports aliases (unique per region)
      • Supports automatic rotation (yearly) or on-demand rotation
      • Can be used by AWS services or custom apps

Billing

KMS Key Policies & Permissions

Data Encryption Keys (DEKs)
Demo: Shell Commands
echo "find all the doggos, distract them with the yumz" > battleplans.txt# Encrypt file
aws kms encrypt \
    --key-id alias/catrobot \
    --plaintext fileb://battleplans.txt \
    --output text \
    --query CiphertextBlob \
    | base64 --decode > not_battleplans.enc # Decrypt file
aws kms decrypt \
    --ciphertext-blob fileb://not_battleplans.enc \
    --output text \
    --query Plaintext | base64 --decode > decryptedplans.txt

S3 Encryption

S3 Encryption In Transit
S3 Object Encryption (Encryption At Rest)
S3 Server-Side Encryption (SSE)

SSE-S3 (AES-256)

SSE-KMS

SSE-C

Summary Table for S3 Encryption At Rest
S3 Encryption MethodKey ManagementCryptographic ProcessingNotes / Extras
SSE-S3Managed by S3Encryption/decryption handled by S3– No control over keys
– No role separation
SSE-KMSManaged by KMS (AWS or customer)S3 performs crypto operations using KMS keys– Key rotation control
– Supports role separation and auditing
SSE-CProvided by customerS3 uses customer key for crypto ops– Keys never stored in AWS
– Supports role separation
CSE (Client-Side Encryption)CustomerEncryption/decryption handled by client– S3 only stores ciphertext
– AWS never sees plaintext

S3 Bucket Keys

Scaling Challenges with S3 SSE-KMS
S3 Bucket Keys for SSE-KMS

S3 Object Storage Classes

Overview of S3 Storage and Classes

Key S3 characteristics:

Billing overview:

S3 storage classes:

  1. “Warm” storage (frequent or infrequent access):
    • Standard, Standard-IA, One-Zone-IA
  2. “Cold” storage (archival):
    • Glacier Instant Retrieval (IR), Glacier Flexible Retrieval (FR), Glacier Deep Archive (DA)
  3. Intelligent-Tiering:
    • Automatically moves objects between tiers based on access patterns.
S3 Standard (Default)
S3 Standard-Infrequent Access (IA)
S3 One Zone-Infrequent Access (1Z-IA)
S3 Glacier Instant Retrieval (IR)
S3 Glacier Flexible Retrieval (FR)
S3 Glacier Deep Archive (DA)

S3 Intelligent-Tiering

S3 Lifecycle Configuration

S3 Lifecycle Management, Configuration, and Rules

Action Types

  1. Transition Actions
    • Move objects to a different storage class after a specified time.
    • Example: Move objects to Glacier-IR 30 days after creation.
  2. Expiration Actions
    • Automatically delete objects or previous versions.
    • Example: Delete previous versions on the first of each month.

Important: Conditions are not based on object access or usage.

Transition Flow

Std → Std-IA → Intelligent-Tiering → 1Z-IA → Glacier-IR → Glacier-FR → Glacier-DA

Exceptions:

Key Considerations

S3 Replication

S3 Replication – Overview

Replication Types:

Use Cases:

S3 Replication – Architecture

S3 Replication – Features

S3 Replication – Considerations & Limitations

S3 Presigned URLs

Limitations of Anonymous S3 Access to Private Resources
S3 Presigned URL – Architecture

How it works:

  1. An IAM user or role calls generatePreSignedURL and provides:
    • Credentials
    • Expiration time
    • Object key
    • Operation type (GET for download or PUT for upload)
  2. S3 returns a presigned URL, which can be shared with external users.

Common Use Cases of Presigned URLs

Presigned URL – Important Behaviors

S3 Select and Glacier Select

S3/Glacier Select – Overview

Key Features

S3 Events

S3 Events – Architecture

Configuration Components

Key Consideration

S3 Access Logs

S3 Server Access Logging – Architecture

Log Structure

Logging Process

Configuration

1. Source Bucket

2. Target Bucket

Important Considerations

Common Use Cases

S3 Object Lock

S3 Object Lock – Key Concepts

Important Considerations

S3 Object Lock – Legal Hold

Use Cases

S3 Object Lock – Retention Period

Retention Modes

1. Governance Mode

Use Cases:

2. Compliance Mode

Use Cases:

S3 Access Points

Scaling Limitations for Granular Configurations in S3 Buckets
S3 Access Points – Architecture

Access Point Policies

Network Access Control

LAB: S3 Multi-Region Access Point (MRAP)

S3 Multi-Region Access Point (MRAP) – Overview
Stage 1 – Create an MRAP
Stage 2 – Configure Replication
Stage 3 – Test the MRAP

Preparation

Test Process

  1. Create a test file: dd if=/dev/urandom of=<file_name> bs=1M count=10
  2. Upload to MRAP: aws s3 cp <file_name> s3://<MRAP_ARN>
  3. Observe which bucket receives the file first

Test Scenarios

Key Insight

Stage 4 – Cleanup