AWS S3 Best Practices
AWS Simple Storage Service (S3) is a storage device for the Internet. It has a web service that makes storage and retrieval simple at any time, from anywhere on the web, regardless of the amount of data. S3 is designed to make web-scale computing simple for developers by providing highly scalable, fast, reliable and inexpensive data storage infrastructure.
Cloud Conformity monitors Amazon S3 following the following rules:
Ensure that your AWS S3 buckets are using DNS-compliant bucket names.
Ensure S3 buckets do not allow FULL_CONTROL access to AWS authenticated users via S3 ACLs.
Ensure S3 buckets do not allow READ access to AWS authenticated users through ACLs.
Ensure AWS S3 buckets do not allow READ_ACP access to AWS authenticated users using ACLs.
Ensure S3 buckets do not allow WRITE access to AWS authenticated users through S3 ACLs.
Ensure S3 buckets do not allow WRITE_ACP access to AWS authenticated users using S3 ACLs.
Ensure Amazon S3 buckets have Default Encryption feature enabled.
Ensure AWS S3 buckets have server access logging enabled to track access requests.
Ensure AWS S3 buckets have the MFA Delete feature enabled.
Ensure that your AWS S3 buckets are not publicly exposed to the Internet.
Ensure AWS S3 buckets do not allow public READ access.
Ensure AWS S3 buckets do not allow public READ_ACP access.
Ensure AWS S3 buckets do not allow public WRITE access.
Ensure AWS S3 buckets do not allow public WRITE_ACP access.
Ensure AWS S3 buckets do not allow public access via bucket policies.
Ensure AWS S3 object versioning is enabled for an additional level of data protection.
Ensure that Amazon S3 buckets are encrypted with customer-provided AWS KMS CMKs.
Ensure Amazon S3 buckets have lifecycle configuration enabled for security and cost optimization purposes.
Ensure S3 buckets with website configuration enabled are regularly reviewed (informational).
AWS S3 configuration changes have been detected within your Amazon Web Services account.
Ensure Amazon S3 buckets do not allow unknown cross account access via bucket policies.
Ensure that AWS S3 buckets use Object Lock for data protection and/or regulatory compliance.
Ensure that Amazon S3 buckets use Transfer Acceleration feature for faster data transfers.
Ensure AWS S3 buckets enforce SSL to secure data in transit
Ensure AWS S3 buckets enforce Server-Side Encryption (SSE)