Amazon S3 Security Controls [Cheat Sheet]
Are you keeping your data stored in AWS safe? Amazon S3 has multiple controls you can use to protect your data. Letβs take a look:β¦
Are you keeping your data stored in AWS safe? Amazon S3 has multiple controls you can use to protect your data. Letβs take a look:
Data access
- S3 Block Public Access: a default deny model for an entire account that is enabled for new buckets, and that orgs can turn on to prohibit any S3 bucket from being made publicly accessible
- IAM policies: User, group, and role-based access control to storage buckets through IAM policies
- Bucket policies: Policies applied to a specific S3 bucket (this enables multiple layers of security for your data since you could have both a bucket policy and IAM policies. ie: if you allow access in a user policy but block access in a bucket policy, access will be denied)
- ACLs: Can grant basic read and write permissions to buckets and objects, to other AWS accounts. This is a legacy feature that should no longer be used unless required for a one-off use case
- Query string auth (aka Presigned URLs): REST-based access key strings that can be passed to AWS for access control
- CORS: can be enabled and configured to allow certain web apps in different domains to access/interact with your resources using specific HTTP methods
- MFA delete: prevent changing Bucket Versioning settings and deleting object versions without MFA
Encryption
- Server-side encryption: using SSE-S3, SSE-KMS, or DSSE-KMS (for 2 separate layers of encryption). Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in S3. All new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance.
- Client-side encryption: This part happens outside of S3. You encrypt your data client-side and upload the encrypted data to S3. You manage the encryption process, encryption keys, and related tools.
Object protection
- Object versioning: keeps multiple versions of an object to track changes and recover from unintended or malicious user actions. Also makes it possible to turn on Object Lock
- S3 Object Lock: turns an S3 bucket into a write-once-read-many (WORM) model. This is useful for legal retention and evidence in chain-of-custody cases, for example.
Logging, Monitoring, Analysis
- AWS CloudTrail data events: enables CloudTrail data events to log S3 object-level API operations in the CloudTrail console
- Server access logs: provides a detailed record of all requests made to an S3 bucket to a separate bucket for collection and analysis. (Tip: CloudTrail logs provide a detailed view of API activity for S3 bucket-level and object-level operations; Server access logs provide visibility into object-level operations on your data stored in S3)
- Pair with Amazon Macie: for monitoring and reporting on sensitive data and access
Follow me on LinkedIn for weekly AWS security content and cheat sheets!
For data protection, access control, and auditing
Amazon S3 Security Controls
Data access controls
S3 Block Public Access
Keep all four settings enabled at both the account and bucket levels unless public access is explicitly required. New buckets have Block Public Access enabled by default.
Centrally enforce settings across accounts with AWS Organizations.
Docs
IAM policies
Identity-based policies define which S3 actions IAM users, groups, and roles can perform. Grant only the required actions and resource ARNs.
An explicit deny overrides an allow.
Docs Bucket policies
Resource-based policies control access to one bucket and its objects, including cross-account access. Combine principals, actions, resources, and conditions.
Use conditions to restrict organization, network, TLS, and encryption requirements.
Docs
RCPs and SCPs
AWS Organizations resource control policies constrain permissions available to S3 resources; service control policies constrain principals in member accounts.
They set maximum permissions. They never grant access.
Docs S3 Access Points
Create named endpoints with their own policies for shared datasets or applications. An access point policy and the underlying bucket policy work together.
Access points can be restricted to requests originating from a VPC.
Docs S3 Access Grants
Grant scoped access by bucket, prefix, or object to IAM identities and users or groups from a corporate directory.
Integrate corporate directory identities through IAM Identity Center.
Docs Access control lists (ACLs)
Legacy grants can provide basic bucket or object permissions to other AWS accounts. New buckets use Bucket owner enforced Object Ownership, which disables ACLs.
Keep ACLs disabled unless a legacy integration specifically requires them.
Docs Presigned URLs
Provide time-limited access to a specific operation using the permissions of the identity that created the URL.
Treat them as bearer tokens, keep lifetimes short, and restrict signature age when appropriate.
Docs CORS
Controls which browser origins, methods, and headers may make cross-origin requests to a bucket.
CORS does not authorize a request. IAM, bucket policies, and other access controls still apply.
Docs MFA Delete
Requires MFA to change a bucketβs versioning state or permanently delete an object version.
Only the bucket ownerβs root account can enable it, using the API or CLI. Incompatible with lifecycle configurations.
Docs Gateway endpoints
Route S3 traffic privately from a VPC without an internet gateway or NAT device. Gateway endpoints have no additional charge.
Use endpoint and bucket policies to limit accessible buckets and actions.
Docs Interface endpoints
Use AWS PrivateLink for private S3 access from on premises over VPN or Direct Connect, or from connected VPCs in other Regions.
Interface endpoint pricing applies.
Docs TLS enforcement
Deny requests that do not use secure transport with the aws:SecureTransport condition in a bucket policy.
Account for AWS service principals when denying on network conditions; service-to-service context can be redacted.
DocsObject protection
S3 Versioning
Keeps multiple object versions so you can recover from accidental overwrites, deletions, or malicious changes.
Monitor storage costs and use lifecycle rules for noncurrent versions.
Docs S3 Object Lock
Protects individual object versions with write-once-read-many retention or legal holds. Requires versioning; supports new and existing general purpose buckets.
Governance retention can be bypassed with permission; compliance retention cannot be shortened, even by root.
Docs
Isolated recovery copies
Use replication or AWS Backup to maintain tested recovery copies in another account or protected backup vault.
Separate administrative access and encryption keys from the source data.
DocsEncryption
Default server-side encryption
Amazon S3 automatically encrypts every new upload with S3-managed keys (SSE-S3) as the base level of encryption.
No extra charge for SSE-S3. Changing default encryption does not re-encrypt existing objects.
Docs
SSE-KMS and DSSE-KMS
Use AWS KMS keys for key-policy control and auditability. DSSE-KMS applies two independent layers of server-side encryption.
S3 Bucket Keys reduce SSE-KMS request costs; they do not support DSSE-KMS.
Docs SSE-C
S3 performs encryption using a key you supply with each read or write request. Keep this option disabled unless required.
Disabled by default for new general purpose buckets since April 2026, and for existing buckets in accounts without SSE-C objects.
Docs Client-side encryption
Encrypt data before upload and decrypt it after download. Your application owns the encryption workflow and key management.
Protect the client-side keys separately from the stored data.
DocsLogging, monitoring, and analysis
Server access logging
Records detailed requests made to a bucket and delivers logs to a destination S3 bucket or CloudWatch Logs.
Delivery is best-effort: records can be delayed, missing, or duplicated.
Docs
CloudTrail data events
Records object-level API activity such as GetObject, PutObject, and DeleteObject.
Opt in through a trail or event data store; charges apply. Data events do not appear in Event history.
Docs CloudTrail management events
Audit bucket-level operations, including changes to bucket policies, versioning, and replication configuration.
Event history includes 90 days of management events per Region. Use a trail or event data store for longer retention.
Docs IAM Access Analyzer
Identify S3 buckets shared publicly or with accounts outside your configured zone of trust.
Review the policy or ACL behind each finding and confirm that the access is intended.
Docs
AWS Config
Record bucket configuration changes and evaluate rules for public access, HTTPS enforcement, versioning, and logging.
Use configuration history and compliance findings to detect drift from your required settings.
Docs
Amazon Macie
Discovers, classifies, and reports sensitive data in S3 using automated discovery or targeted discovery jobs.
Use findings to prioritize exposure and data-protection work.
Docs
GuardDuty S3 Protection
Analyzes S3 data events to identify suspicious or malicious access patterns, including possible data exfiltration or destruction.
Uses an independent event stream; you do not need to enable CloudTrail data-event logging for GuardDuty.
Docs Storage Lens and S3 Inventory
Use Storage Lens for organization-wide usage and protection metrics; use S3 Inventory to audit object encryption and replication status.
Review trends and exceptions on a recurring schedule.
DocsUse this cheat sheet with AI
Copy a ready-to-use prompt into your preferred AI assistant.
