30.4 Protecting Data: S3, Encryption and Secrets
S3 exposure is the classic cloud leak. Defences:
- Turn on S3 Block Public Access at the account level (S3 console, Block Public Access settings for this account). This overrides mistakes on individual buckets.
- Serve public files through CloudFront with Origin Access Control instead of making the bucket public.
- Use bucket policies that allow only your app role; enable versioning so deleted or ransomed files can be restored.
aws s3api get-public-access-block --bucket reels-media-pune
aws s3api put-public-access-block --bucket reels-media-pune \
--public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
aws s3api put-bucket-versioning --bucket reels-media-pune --versioning-configuration Status=Enabled
Encryption. S3 encrypts new objects by default (SSE-S3). For more control use KMS keys (SSE-KMS): you decide who may use the key, and every use is logged in CloudTrail. Tick "Encryption" when creating RDS and EBS volumes – it cannot be switched on later without a snapshot copy.
Secrets. Database passwords and API keys belong in AWS Secrets Manager or SSM Parameter Store (SecureString), not in config.php committed to Git.
aws ssm put-parameter --name /reels/db/password --type SecureString --value 'Str0ng#Pass'
aws ssm get-parameter --name /reels/db/password --with-decryption --query Parameter.Value --output text
The EC2 role then needs only ssm:GetParameter on that one parameter.
Ravindra Bagale's Tip
The reason for making a bucket "public" is always "the images weren't showing". The right fix for that is CloudFront + OAC, not a public bucket. And once you turn on account-level Block Public Access, future mistakes are stopped automatically too.
Ravindra Bagale's Tip – मराठी
Bucket "public" करण्याचे कारण नेहमी "images दिसत नव्हते" असते. त्याचा योग्य उपाय CloudFront + OAC आहे, public bucket नाही. आणि account-level Block Public Access एकदा चालू केला की भविष्यातली चूक पण आपोआप थांबते.
Ravindra Bagale's Tip – हिंदी
Bucket "public" करने की वजह हमेशा "images नहीं दिख रही थीं" होती है. उसका सही उपाय CloudFront + OAC है, public bucket नहीं. और account-level Block Public Access एक बार चालू कर दिया तो आगे की गलती भी अपने-आप रुक जाती है.
Lab
Enable account-level Block Public Access. Move the database password of your reels app from config.php into SSM Parameter Store as a SecureString, give the EC2 role permission to read only that parameter, and update the PHP code to fetch it with the AWS SDK.