Question about to secure S3

Question

As captioned, how to secure S3 bucket in multi-account environments?

Kidd Ip · Accepted Answer

Take this:

1. Use Bucket Policies with aws:PrincipalOrgID

```
{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": "arn:aws:s3:::your-bucket-name/*",
  "Condition": {
    "StringEquals": {
      "aws:PrincipalOrgID": "EXAMPLE"
    }
  }
}
```

2. Set Up Cross-Account IAM Roles
•	In the bucket-owning account, create a role with permissions to access the bucket.
•	In the other account, allow users or services to assume that role.
•	This is more scalable and auditable than using access keys.
3. Disable ACLs and Use Bucket Owner Enforced Mode
•	ACLs are legacy and messy.
•	Use S3 Object Ownership to enforce that the bucket owner owns all objects.
•	This simplifies access control and avoids ownership conflicts.
4. Enable Logging and Access Analyzer
•	Turn on S3 server access logging or CloudTrail data events to monitor usage.
•	Use IAM Access Analyzer to detect unintended public or cross-account access.
5. Use VPC Endpoints for Private Access
•	If your workloads are in VPCs, use S3 Gateway Endpoints to keep traffic off the public internet.
•	Combine with bucket policies that only allow access via the endpoint.

Gunasekaran, Makendran · Answer

For securing S3 buckets across AWS accounts, here are the key security measures to implement:

1. Set up cross-account IAM roles instead of using access keys, as this provides better scalability and auditability.

2. For encryption requirements:

- Use either SSE-KMS with customer managed keys (CMK) or SSE-S3 encryption 
- Avoid AWS managed SSE-KMS keys as they don't allow cross-account access

3. Configure access controls:

- Disable ACLs and use bucket owner enforced mode to simplify access management  
- Enable logging and use IAM Access Analyzer to detect unintended public or cross-account access  
- Use VPC endpoints for private access to keep traffic within AWS network

When implementing cross-account permissions: 
- Configure bucket policies to allow only required roles from other accounts  
- Ensure KMS key policies grant appropriate permissions if using customer managed keys  
- Follow principle of least privilege when granting access

For monitoring and compliance: 
- Enable CloudTrail for detailed action logging  
- Set up access logging to track bucket usage  
- Regularly review and audit access patterns

### Reference

1. [How do I grant cross-account access to objects that are in Amazon S3 buckets?](https://repost.aws/knowledge-center/cross-account-access-s3)
2. [Using AWS Identity and Access Management Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html)
3. [Enabling CloudTrail event logging for S3 buckets and objects](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html)

Question about to secure S3

Reference

Add your answer

Relevant content