3 ms·
> If you host sensitive or private data on your S3 account, you wouldn’t want anyone to find it with a simple Google search query. To prevent search engines fro
by ryandvm 17y ago
> If you host sensitive or private data on your S3 account, you wouldn’t want anyone to find it with a simple Google search query. To prevent search engines from indexing your bucket, place a file named robots.txt in the bucket.
Wow - this is a security blog? If you host sensitive data, don't make it publicly readable at all. Documenting its existence in a world-readable robots.txt is a recipe for disaster.
- goglog 17y agoNot exactly true. I use S3 account to host my files only. I don't use it for hosting or whatsoever. If I use robots.txt, I prevent it from appearing in Google and since you don't know my bucket name or my S3 account name, you can't read my robots.txt file.
- rgrove 17y agoIf you need a robots.txt, you're doing it wrong. Set the ACLs on your buckets and files so that they're not readable or listable by anyone but you. There's no reason to depend on obscurity to protect your data when you can easily secure it using ACLs.