Hardening S3 bucket

Question

We store RPMs required for our deployment in a S3 bucket, we are hosting a yum repo on the bucket to make it easier for updating RPMS.

Currently, our bucket is accessible publicly over the S3 endpoint (s3.amazonaws.com) and open to the world for access as we currently can’t pull down yum packages from a private S3 repo.

We need to harden the security of the Repo bucket to enable authentication based access to S3 over s3.amazonaws.com endpoint. Any suggestion towards it ? Thanks !

`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow Access From QA, dev",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                     
                    "arn:aws:iam::XXXXXXX:root"
                ]
            },
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::test-repo",
                "arn:aws:s3:::test-repo/*"
            ],
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "X.X.X.X/32"
                     ]
                },
                "StringNotEquals": {
                    "aws:sourceVpce": "vpce-xxxxxxx"
                }
            }
        }
    ]
}
`

user_13460933 · Answer

Rather than trying to specifically add an authentication layer take a look at adding a VPC endpoint to the VPC(s) that you want to be able to access your S3 bucket.

Once you have this in place (and added to the route tables) then you can update the bucket policy for your S3 bucket to add a condition to Deny all traffic not from the source VPC endpoint (aws:sourceVpce).

The advantage to this approach is that you will not need to make any changes to the servers themselves.

Hardening S3 bucket

1 Answers