presignedurl security

Question

Hi team

I'm using a lambda function to generate a presigned URL to allow partner application/VPC to upload files and get files from an S3 bucket in my AWS account.

The reason for that is to avoid sending the binary data over the private link to avoid bottleneck on the private link traffic,

but the security team is concerned about how secure the pre-signed URLs are.

I thought it would be better to use pre-signed URLs instead of sending many thousands.... of files over the privatelink?

I know that Anyone who obtains the URL before expiry can use it to access the data, can that be improved by bucket policy or still a security issue

Tank you!

Answer

You could add a bucket policy that only allows access from specific VPC endpoints. See: [Controlling access from VPC endpoints with bucket policies](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html).

The traffic over a VPC Endpoint stays on the AWS network. However, even traffic routed out an Internet Gateway will stay on the AWS network if calling AWS services. See this [FAQ](https://aws.amazon.com/vpc/faqs/#Connectivity):

```
Q. Does traffic go over the internet when two instances communicate using public IP 
addresses, or when instances communicate with a public AWS service endpoint?
 
No. When using public IP addresses, all communication between instances and services 
hosted in AWS use AWS's private network. Packets that originate from the AWS network 
with a destination on the AWS network stay on the AWS global network, except traffic 
to or from AWS China Regions.
 
In addition, all data flowing across the AWS global network that interconnects our  
data centers and Regions is automatically encrypted at the physical layer before it 
leaves our secured facilities. Additional encryption layers exist as well; for example, 
all VPC cross-region peering traffic, and customer or service-to-service 
Transport Layer Security (TLS) connections. 
```

presignedurl security

관련 콘텐츠