By using AWS re:Post, you agree to the Terms of Use

S3 content protection and deletion methods

0

Hi there,

I'm looking to compile a complete list of ways to protect data in S3 from accidental or malicious deletion. Assuming that Object locking is not in play, and that we can't rely on cross-region replication for a redundant copy, are there any other ways to completely destroy data aside from the following:

  1. DeleteObject API Call from an authenticated IAM principal (be that a role or a user)
  2. PutObject API Call over an existing object without object versioning in play.
  3. A lifecycle policy that deletes objects.
  4. The Root user issues a DeleteObject Call

Note that in certain infrequent administrative circumstances, I will need to still be able to delete an object (So object locking with compliance mode is not usable here)

In short, It appears that data can be protected from Administrators (: permissions on *) by doing the following (please confirm?):

Either:

  1. Implement Object Locking in governance mode
  2. Explicitly Deny s3:BypassGovernanceRetention and s3:GetBucketObjectLockConfiguration
  3. Enable detective measures to undo these configurations.
  4. Prevent the root account from being used

OR:

  1. Explicitly deny s3:DeleteObject, s3:DeleteObjectVersion, and s3:PutLifecycleConfiguration
  2. Enable Versioning (to prevent overwrite)
  3. Enable detective measures to undo these configurations.
  4. Prevent the root account from being used

OR:

  1. Store a redundant copy of the object in a backup bucket and protect accordingly.
  2. Restrict IAM access completely to backup copy
  3. Enable detective measures to undo these configurations.
  4. Prevent the root account from being used
asked 2 years ago84 views
1 Answer
0
Accepted Answer

They all look good to me, one more way would be using MFA delete to protect your data.

You can lock root out of that as well but as root user, you have permissions to delete bucket policies. So, you delete existing one and put a new one back.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions