AWS Announces New S3 Encryption Features
AWS Announces New S3 Encryption Features
AWS just announced a variety of new encryption features for S3 buckets, including some ease of use enhancements, permissions checks, and more.
Join the DZone community and get the full member experience.Join For Free
Learn how to migrate and modernize stateless applications and run them in a Kubernetes cluster.
Amazon Web Services (AWS) recently announced new Simple Storage Service (S3) encryption and security enhancements including Default Encryption, Permission Checks, Cross-Region Replication ACL Overwrite, Cross-Region Replication with KMS, and Detailed Inventory Reports. Another recent announcement by AWS is for PrivateLinks endpoints within a Virtual Private Cloud (VPC).
AWS Service Dashboard
Extending previous security features, now you can mandate all objects stored in a given S3 bucket be encrypted without specifying a bucket policy that rejects non-encrypted objects. There are three server-side encryption (SSE) options for S3 objects: keys managed by S3, AWS KMS, and SSE Customer (SSE-C) managed keys. These options provide more flexibility as well as control for different environments along with increased granularity. Note that encryption can be forced on all objects in a bucket by specifying a bucket encryption configuration. When an unencrypted object is stored in an encrypted bucket, it will inherit the same encryption as the bucket, or, alternately specified by a PUT required.
AWS S3 Buckets
There is now an indicator on the S3 console dashboard prominently indicating which S3 buckets are publicly accessible. In the above image, some of my AWS S3 buckets are shown, including one that is public facing. Note in the image above how there is a notion next to buckets that are open to the public.
Cross-Region Replication ACL Overwrite and KMS
AWS Key Management Service (KMS) keys can be used for encrypting objects. Building on previous cross-region replication capabilities, now when you replicate objects across AWS accounts, a new ACL providing full access to the destination account can be specified.
Detailed Inventory Report
The S3 Inventory report (which can also be encrypted) now includes the encryption status of each object.
PrivateLink for AWS Services
PrivateLinks enable AWS customers to access services from a VPC without using a public IP as well as traffic not having to go across the Internet (e.g. keeps traffic within the AWS network. PrivateLink endpoints appear in Elastic Network Interface (ENI) with private IPs in your VPC and are highly available, resiliency and scalable. Besides scaling and resiliency, PrivateLink eliminates the need for whitelisting of public IPs as well as managing internet gateway, NAT, and firewall proxies to connect to AWS services (Elastic Cloud Compute (EC2), Elastic Load Balancer (ELB), Kinesis Streams, Service Catalog, EC2 Systems Manager). Learn more about AWS PrivateLink for services here including VPC Endpoint Pricing here.
Where to Learn More
Learn more about related technology, trends, tools, techniques, and tips with the following links.
- Cloud conversations: AWS EBS, Glacier and S3 overview (Part I)
- AWS S3 Storage Gateway Revisited (Part I)
- Amazon Web Service AWS September 2017 Software Defined Data Infrastructure Updates
- S3motion Buckets Containers Objects AWS S3 Cloud and EMCcode
- Cloud conversations: AWS EBS, Glacier, and S3 overview (Part II S3)
- Cloud Conversations: AWS S3 Cross Region Replication storage enhancements
- Part II Revisiting AWS S3 Storage Gateway (Test Drive Deployment)
- Software Defined Data Infrastructure Essentials (CRC Press 2017)
What This All Means
Common cloud concern considerations include privacy and security. AWS S3 among other industry cloud service and storage providers have had their share of not so pleasant news coverage involving security.
Keep in mind that data protection including security is a shared responsibility (and only you can prevent data loss). This means that the vendor or service provider has to take care of their responsibility making sure their solutions have proper data protection and security features by default, as well as extensions, and making those capabilities known to consumers.
The other part of shared responsibility is that consumers and users of cloud services need to know what the capabilities are, defaults and options as well as when to use various approaches. Ultimately it is up to the user of a cloud service to implement best practices to leverage cloud as well as their own on-premise technologies so that they can support data infrastructure that in turn protect, preserve, secure and serve information (along with their applications and data).
These are good enhancements by AWS to make their S3 cloud storage security encryption features available as well as provide options and awareness for users on how to use those capabilities.
Ok, nuff said, for now.
Published at DZone with permission of Greg Schulz , DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.