Some notable S3 bucket-related breaches in the past include FedEx, Verizon, and Dow Jones.

Unfortunately, many organizations don’t have the necessary resources and skills needed to build and maintain highly secured AWS environments.ĪWS S3 leaks have reappeared in headlines time and time again. The risk of a data breach due to misconfigurationĪWS S3 promises high levels of security, when understood and configured properly. Organizations may have hundreds of S3 buckets, but they are responsible for ensuring that S3 buckets are secured, monitored, and not publicly accessible. Customers and users are also expected to shoulder the responsibility to secure their information within the cloud by closing data security loops.ĪWS S3 storage is categorized as Infrastructure as a Service (IaaS) and AWS clearly states that organizations are responsible for the security configurations (i.e., implement appropriate access control policies) with control and management tasks. While AWS provides reliable security, it does not cover the entire extent of security needed. Moreover, S3 supports both read and write permissions.Ĭloud storage security shared responsibility model Also, S3 buckets are not centrally “secured.” The configuration complexity coupled with the flexibility of bucket policies to modify configurations offered by S3 bucket security can lead to mistakes. New S3 buckets can be created in seconds, hence the need for constant monitoring-which means continuous assessment and remediation for policy violations. Terraform) allows a single misconfiguration to impact hundreds-if not thousands-of assets with a single line of code. Configuration mistakes keep happening because cloud security management at scale is complex. As data and resources are created, deployed, and modified quickly in AWS S3 storage, cloud security teams must address security issues quickly and effectively.ĪWS S3 storage enables organizations to store massive datasets on a secure platform. You won’t have to look far to find stories of S3-related data breaches caused by misconfiguration, where S3 security settings were left set to “public.” Since 2017, there has been an overwhelming number of sensitive data disclosure scenarios and breaches involving misconfigured and publicly available Amazon S3 buckets. Breaches related to S3 buckets are frighteningly common, exposing sensitive information and causing brand and financial damage. Amazon S3 storage is incredibly flexible and easy to use, but securing S3 has proven difficult for many organizations.