Amazon S3 encryption and access control best practices
summary
New S3 defaults automatically apply encryption by default (SSE‑S3) to all new objects and block public access enabled by default for new buckets, while object‑level PUT headers win over bucket defaults so you must enforce KMS usage with bucket policies. AWS introduces S3 bucket keys reduce KMS calls up to 99% (customers saved ~$80M) and optional DSSE‑KMS dual‑layer encryption. ACLs are disabled on new buckets by default; use S3 Storage Lens, Access Analyzer, and server access logs/CloudTrail to find and fix exceptions.
AI-written summary · about
chapters (10)
- 0:00Introduction to S3 security
- 2:11New secure defaults in S3
- 3:55Encryption options in S3
- 10:43How S3 encryption works
- 17:23Auditing encryption with S3 Storage Lens
- 17:46Block public access explained
- 24:32IAM and bucket policies
- 37:03Disabling ACLs in S3
- 40:21Access Analyzer and logging
- 43:27Summary of best practices
related talks
26mProtecting your data in Amazon S3
38mSecuring Amazon S3 with guardrails and fine-grained access controls
19mManaging access to your Amazon S3 buckets and objects
18mImproving your Amazon S3 security with cost-effective practices
27mEncrypting 6 Petabytes of Customer Data with AWS KMS
19mFoundations of data security
07m15 years of Amazon S3 - Security is Job Zero
27mProactively identifying threats & protecting sensitive data in S3