Open menu

S3 Transfer Acceleration

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features
Performance
efficiency
Risk level: Low (generally tolerable level of risk)
Rule ID: S3-024

Ensure that your S3 buckets are using Transfer Acceleration feature to increase the speed (up to 500%) of data transfers in and out of Amazon S3 using AWS edge network. S3 Transfer Acceleration feature enables fast, easy and secure transfers of files over long distances between your S3 bucket and your client(s) by taking advantage of AWS CloudFront's globally distributed edge locations. Once Transfer Acceleration is enabled, as soon as your S3 objects reach an edge network location, the data is routed to Amazon S3 over an optimized network path.

This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS

If your applications need to transfer gigabytes to terabytes of data across or between continents, use large S3 objects, or just have a lot of users that upload data to a centralized bucket from all over the world, S3 Transfer Acceleration comes to rescue. This feature also comes in handy when you are unable to use all of your available bandwidth over the Internet when uploading your data to S3.

Note: To enable Transfer Acceleration for your S3 buckets, the name of these buckets must be DNS-compliant and must not contain periods (i.e. ".").

Audit

To determine if your Amazon S3 buckets use Transfer Acceleration, perform the following actions:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Click on the name of the S3 bucket that you want to examine to access the bucket configuration.

04 Select the Properties tab from the S3 dashboard top menu and check the Transfer Acceleration status. If the feature status is set to Suspended, the S3 Transfer Acceleration is not enabled for the selected Amazon S3 bucket.

05 Repeat step no. 3 and 4 to verify Transfer Acceleration status for other S3 buckets available in your AWS account.

Using AWS CLI

01 Run list-buckets command (OSX/Linux/UNIX) using custom query filters to list all existing S3 buckets available within your AWS account:

aws s3api list-buckets 
	--query 'Buckets[*].Name'

02 The command output should return the names of your S3 buckets:

[
    "cc-app-repository",
    "cc-project5-media",
    "cc-project5-logs"
]

03 Run get-bucket-accelerate-configuration command (OSX/Linux/UNIX) using the name of the S3 bucket that you want to examine as identifier and custom query filters to get the S3 Transfer Acceleration configuration status for the selected bucket:

aws s3api get-bucket-accelerate-configuration
	--bucket cc-app-repository
	--query 'Status'

04 The command output should return the feature configuration status:

"Suspended"

If the get-bucket-accelerate-configuration command output returns "Suspended", as shown in the output example above, or null, if the feature was never enabled, the S3 Transfer Acceleration is not in use for the selected Amazon S3 bucket.

05 Repeat step no. 3 and 4 for each S3 bucket that you want to examine for Transfer Acceleration, available in your AWS account.

Remediation / Resolution

To enable Amazon S3 Transfer Acceleration for your existing S3 buckets, perform the following actions:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

03 Click on the name of the S3 bucket that you want to reconfigure (see Audit section part I to identify the right S3 resource).

04 Select the Properties tab from the dashboard top menu then click the Transfer Acceleration box to access the feature settings.

05 Inside Transfer Acceleration box, perform the following:

  1. Select Enabled to enable Transfer Acceleration feature.
  2. From Endpoint, copy the new accelerated endpoint (i.e. <s3-bucket-name>.s3-accelerate.amazonaws.com) required for faster data transfers.
  3. Click Save to apply the changes.

or delete the predefined group using the x button next to the permissions settings:

06 Replace the existing bucket endpoint (bucket URL) with the endpoint domain name copied at the previous step in your S3 client configuration and/or application code to make use of S3 Transfer Acceleration feature. Once the endpoint is configured, your S3 client/application connections will be routed to the optimal AWS edge location based on latency, for accelerated data transfer. Note that additional data transfer charges may apply.

07 Repeat steps no. 3 – 6 to enable and configure Amazon S3 Transfer Acceleration for other S3 buckets available in your AWS account.

Using AWS CLI

01 Run put-bucket-accelerate-configuration command (OSX/Linux/UNIX) using the name of the S3 bucket that you want to reconfigure as identifier (see Audit section part II to identify the right resource), to turn on Transfer Acceleration for the specified S3 bucket. If the command request is successful, the acceleration-enabled bucket will receive an endpoint with the following format: <s3-bucket-name>.s3-accelerate.amazonaws.com (the command does not produce an output):

aws s3api put-bucket-accelerate-configuration
	--bucket cc-app-repository
	--accelerate-configuration Status=Enabled

02 Replace the S3 existing bucket endpoint/URL with the new endpoint (i.e. <s3-bucket-name>.s3-accelerate.amazonaws.com) in your S3 client configuration and/or application code to make use of Transfer Acceleration feature. Once the endpoint is configured, your S3 client/application TCP connections will be routed to the optimal AWS edge location based on latency, for accelerated data transfer. Additional data transfer charges may apply.

03 Repeat steps no. 1 and 2 to enable and configure Amazon S3 Transfer Acceleration for other S3 buckets available within your AWS account.

References

Publication date Feb 20, 2019

Thanks!

A verification email has been sent to

Thanks!

A verification email has been sent to

Thanks!

A verification email has been sent to