Securing Amazon S3 with guardrails and fine-grained access controls
summary
S3 defaults to private and AWS layers perimeter and fine-grained controls: Block Public Access (2018) prevents accidental public buckets, principal org id and resource account checks restrict cross‑account access, VPC endpoints (2015) plus VPC endpoint policy enforce network‑based guardrails and extend to on‑prem via interface endpoints, S3 Access Points (2019) let each sharing scenario have its own policy, SSE‑KMS plus Bucket Keys cut encryption cost, and Lake Formation adds table/column level authorization for analytics.
AI-written summary · about
chapters (12)
- 0:00Introduction and overview
- 1:05S3 history and evolution
- 7:28Coarse-grained guardrails in S3
- 10:14Block public access feature
- 12:23Principal org ID and data ownership
- 13:49Network perimeter controls
- 19:22Fine-grained access management
- 24:42Encryption and access control
- 27:11Lake Formation for analytics
- 29:19Security as job zero
- 30:23Q&A on auditing S3 sprawl
- 34:50Q&A on data subset access
related talks
45mAmazon S3 encryption and access control best practices
44mGuardrails in the Cloud
38mEstablishing a Data Perimeter on AWS
58mCreate enterprise-wide preventive guardrails
18mImproving your Amazon S3 security with cost-effective practices
57mEstablishing a data perimeter on AWS
13mSimplifying data security in a complex data lake environment
27mIntroduction to AWS Security