8 ms·

It's still too confusing. Too much terminology, too many settings. 3 pages and over half a dozen screenshots to explain how to make a bucket private. Too compli

It's still too confusing. Too much terminology, too many settings. 3 pages and over half a dozen screenshots to explain how to make a bucket private. Too complicated. Google Drive folder permissions are easier. Phrases like "Anyone with the link can view" are understandable. Phrases like "Block public and cross-account access to buckets that have public policies" are not. Hide the fine-grained control in an "Advanced" panel, for those who really need it.

ABeeSea 8y ago
I’m pretty sure buckets are private by default.
- shepardrtc 8y ago
  They are private by default. This is just making public/private settings very explicit, and also helping to ensure that anything that was public before the default setting was changed to private is known. This is really just extra CYA because people who really don't know what they are doing are apparently still being put in charge of buckets by companies.
  - privateSFacct 8y ago
    Totally true! Some folks use S3 kind of a like a quick dropbox to share big files even internally in an org. Bob in accounting to Sue in finance. One solution I've found if folks INSIST they do not want any login / security. Expose the bucket contents using time expiring shared links (presigned links). This has worked great in one use case I had where users INSISTED on no security with sensitive data. Users can then cut / paste / download / share links for a few hours (all they really want - send it to a few folks on a project). Even if their email is hacked you are OK. Not ideal, but better than nothing. If you look inside orgs, the desire for no security is sometimes surprisingly high!
    - isostatic 8y ago
      > the desire for no security is sometimes surprisingly high! The desire for security to not get in the way is high.
    - closeparen 8y ago
      Those folks are wrong, and the correct answer here is for AWS to stop them. Google Drive and Box are appropriate solutions for that use case. Maybe AWS should launch one too.
      - scarface74 8y ago
        The simplest way is to use CloudBerry. It maps an S3 bucket to a Windows drive.
    - shepardrtc 8y ago
      You could also set up a lifecycle policy to delete anything in the bucket after a day to add even more security.
- cjcampbell 8y ago
  They are private by default, but it was far too easy for a to enable public access through a bucket policy that seemed sane to the untrained eye. In the systems I've designed, I've built multiple layers of protection around sensitive buckets. I figure it's safest to assume that someone will eventually screw up the policy. When possible, I deny access to the bucket except for explicit whitelisted approvals (alternatively, requests coming from IAM roles or users in the current account). I also encrypt buckets by default and often deny unencrypted uploads. The concept of public access doesn't map in quite the same way to customer-managed KMS keys, so you have good odds that S3 requests would fail on decryption even when a bucket becomes public. Next layer of protection is monitoring via Config rules and Trusted Advisor checks, combined with alarms to ensure that these alerts are actually brought to someone's attention. Finally, except for development accounts, I insist on automating configuration of the environment (and aim to use IAM to prevent manual changes). This is great if you can pull it off, but you don't get there overnight. And you certainly don't get here by relying only on the basic documentation. I would say you don't even necessarily get there by relying on AWS partners. I've seen more than a couple disappoint. All of this to say that I'm happy to add one more guardrail (with much lower overhead).
  - scarface74 8y ago
    This is exactly the right approach. AWS hammers people about the “shared security model”, being in the cloud doesn’t stop you from doing stupid stuff. You have all kinds of tools to help you do the right thing.
privateSFacct 8y ago
This again is misleading, users blaming AWS for making bucket's public. The bucket's start out __private__. The UI when making a bucket public comes with a big warning. Then a big warning label is attached next to the bucket itself. It does show I think the scale of AWS that the userbase is so large that this isn't clear. This tool is nice because it means that a perhaps more experienced admin can lock down an entire account a bit more so newer devs looking to shortcut things with world public aren't as able to (which will slow them down for sure).
- Novashi 8y ago
  IIRC they didn’t used to be private by default or it was really easy to make it public.
  - jeffbarr 8y ago
    They have been private by default since the launch of S3 in 2006.
- ticmasta 8y ago
  >> he bucket's start out __private__. Except one of the biggest initial selling points is hosting static websites, which requires the bucket to be public. They even have a shortcut UI for setting this up, but then they highlight this "security issue" that you have a public bucket, which doesn't make sense. If you've gone to the trouble to specify the bucket is a website with default documents, etc, surely they can filter these buckets out of the ALERT! PUBLIC BUCKET! list...
  - Alex3917 8y ago
    > Except one of the biggest initial selling points is hosting static websites, which requires the bucket to be public. Maybe S3 should just be separated into buckets and websites. They can work the same under the hood, but call them something different to prevent this issue. Right now a lot of the new (and existing) security settings don't make any sense in the context of websites, and having the functionality to make websites within S3 creates security issues for everyone else.
masklinn 8y ago
> Google Drive folder permissions are easier. They're still crap though e.g. you can have public resources (or broad access & findable within orgs) inside locked down "folders", there is no way to make a "folder"'s access recurse, if you find out that a "folder" had the wrong access rights it's absolute hell to fix it.
- kartickv 8y ago
  Or get a list of documents sorted by access level or the person you've shared it with. Like a CA you hired 3 years ago to file your taxes no longer needs access to your financial information.
driverdan 8y ago
All of AWS' access control is too confusing. Unless you spend a lot of time managing AWS it's hard to remember how to configure IAM and ACLs. I have to read the docs almost every time I change something just to be sure I don't screw it up. At my last job our team actively avoided touching IAM as much as possible because we all hated it.
- koboll 8y ago
  You can tell how old a service is by its name. Most of the old ones have cutesy in-joke names. Most of the new ones are named exactly for what they do. They realized having 400 cutesy joke names was exhausting.
  - rmwaite 8y ago
    How is IAM a cutesy name?
    - denisw 8y ago
      It can be read as both an acronym for “Identity and Access Management” and as the phrase “I am”, which also happens to fit the topic of identity.
      - yread 8y ago
        err it's the same in google cloud
      - arbie 8y ago
        Never noticed this before, and now can never unsee it. Thank you.
      - morpheuskafka 8y ago
        True, but that would apply to everyone else that uses the acronym, not something Amazon invented.
  - lclarkmichalek 8y ago
Alex3917 8y ago
Great changes! But, there should also be an account-wide option just to ban public uploads to a bucket. For anyone running a website, checking any of these 'recommended' boxes is going to take down prod. (I just started checking boxes impulsively to see what would happen; fortunately any changes revert quickly!)
- scarface74 8y ago
  I would go so far as to put public S3 buckets for websites into a separate account.
ZWoz 8y ago
"Too confusing" can be feature though. Older Microsoft strategy, now you have good ground for integrators and value added resellers. Guys, who know specific platform,so they sell it and promote it for every chance.
deleted 8y ago
[deleted]
scarface74 8y ago
You’ve never had to figure out how to make your buckets private. They are private by default. This new feature adds another level of protection against making a bucket public. Making a bucket public is a very simple understandable option in the interface. The screenshots were just there to illustrate how even if the bucket is public the new feature will block it on the account level. Comparing Google Drive to S3 is not really valid. No one is using Google Drive as an enterprise level access storage solution that can serve millions of requests.
- vhold 8y ago
  The problem is really that sharing securely is way too complicated. So inexperienced or lazy people give up and make the bucket public so they can get on with whatever it was they were trying to accomplish.
  - scarface74 8y ago
    They shouldn’t be able to access AWS if they don’t know what they are doing. Alternatively, the admins should set up of a simple CloudTrail rule to alert them. Being “in the cloud” doesn’t abrogate your responsible for security governance and monitoring.
INTPenis 8y ago
So true. I just started AWS development and sure I managed to trudge through it carefully and make sure my buckets had the correct policy. But I can totally understand how a lot of people are making mistakes. AWS is very overwhelming even to an experienced Linux admin and programmer. And even with the bucket policy generator you're left reading a lot of documentation to understand what you need to input. Add on top of that a person from a non-english speaking country and it's a recipe for privacy disaster.
- scarface74 8y ago
  I’m sure Linux administration will be just as overwhelming and confusing to me once I start getting into it as an experienced (20+ years) Microsoft developer who has cut my teeth on all things AWS except for the machine learning parts.... Its all about context.
closeparen 8y ago
Google Drive and AWS are not interchangeable tools. One is for use by end-users, the other by software.
tzhenghao 8y ago
This. I've been using AWS for my side projects, but strongly considered moving to GCP at some point. Sometimes I swear I feel like I need a phd in AWS literature to even set up a box with the "right" permissions for my friends. Sure, I'm no sysadmin, but it's mind blogging that setting up a cloud instance feels harder than doing it all on premise.
jhwang5 8y ago
With that mindset, you have no business using AWS.

ABeeSea 8y ago

I’m pretty sure buckets are private by default.

shepardrtc 8y ago
They are private by default. This is just making public/private settings very explicit, and also helping to ensure that anything that was public before the default setting was changed to private is known. This is really just extra CYA because people who really don't know what they are doing are apparently still being put in charge of buckets by companies.
- privateSFacct 8y ago
  Totally true! Some folks use S3 kind of a like a quick dropbox to share big files even internally in an org. Bob in accounting to Sue in finance. One solution I've found if folks INSIST they do not want any login / security. Expose the bucket contents using time expiring shared links (presigned links). This has worked great in one use case I had where users INSISTED on no security with sensitive data. Users can then cut / paste / download / share links for a few hours (all they really want - send it to a few folks on a project). Even if their email is hacked you are OK. Not ideal, but better than nothing. If you look inside orgs, the desire for no security is sometimes surprisingly high!
  - isostatic 8y ago
    > the desire for no security is sometimes surprisingly high! The desire for security to not get in the way is high.
  - closeparen 8y ago
    Those folks are wrong, and the correct answer here is for AWS to stop them. Google Drive and Box are appropriate solutions for that use case. Maybe AWS should launch one too.
    - scarface74 8y ago
      The simplest way is to use CloudBerry. It maps an S3 bucket to a Windows drive.
  - shepardrtc 8y ago
    You could also set up a lifecycle policy to delete anything in the bucket after a day to add even more security.
cjcampbell 8y ago
They are private by default, but it was far too easy for a to enable public access through a bucket policy that seemed sane to the untrained eye. In the systems I've designed, I've built multiple layers of protection around sensitive buckets. I figure it's safest to assume that someone will eventually screw up the policy. When possible, I deny access to the bucket except for explicit whitelisted approvals (alternatively, requests coming from IAM roles or users in the current account). I also encrypt buckets by default and often deny unencrypted uploads. The concept of public access doesn't map in quite the same way to customer-managed KMS keys, so you have good odds that S3 requests would fail on decryption even when a bucket becomes public. Next layer of protection is monitoring via Config rules and Trusted Advisor checks, combined with alarms to ensure that these alerts are actually brought to someone's attention. Finally, except for development accounts, I insist on automating configuration of the environment (and aim to use IAM to prevent manual changes). This is great if you can pull it off, but you don't get there overnight. And you certainly don't get here by relying only on the basic documentation. I would say you don't even necessarily get there by relying on AWS partners. I've seen more than a couple disappoint. All of this to say that I'm happy to add one more guardrail (with much lower overhead).
- scarface74 8y ago
  This is exactly the right approach. AWS hammers people about the “shared security model”, being in the cloud doesn’t stop you from doing stupid stuff. You have all kinds of tools to help you do the right thing.

privateSFacct 8y ago

This again is misleading, users blaming AWS for making bucket's public. The bucket's start out __private__. The UI when making a bucket public comes with a big warning. Then a big warning label is attached next to the bucket itself. It does show I think the scale of AWS that the userbase is so large that this isn't clear. This tool is nice because it means that a perhaps more experienced admin can lock down an entire account a bit more so newer devs looking to shortcut things with world public aren't as able to (which will slow them down for sure).

Novashi 8y ago
IIRC they didn’t used to be private by default or it was really easy to make it public.
- jeffbarr 8y ago
  They have been private by default since the launch of S3 in 2006.
ticmasta 8y ago
>> he bucket's start out __private__. Except one of the biggest initial selling points is hosting static websites, which requires the bucket to be public. They even have a shortcut UI for setting this up, but then they highlight this "security issue" that you have a public bucket, which doesn't make sense. If you've gone to the trouble to specify the bucket is a website with default documents, etc, surely they can filter these buckets out of the ALERT! PUBLIC BUCKET! list...
- Alex3917 8y ago
  > Except one of the biggest initial selling points is hosting static websites, which requires the bucket to be public. Maybe S3 should just be separated into buckets and websites. They can work the same under the hood, but call them something different to prevent this issue. Right now a lot of the new (and existing) security settings don't make any sense in the context of websites, and having the functionality to make websites within S3 creates security issues for everyone else.

masklinn 8y ago

> Google Drive folder permissions are easier. They're still crap though e.g. you can have public resources (or broad access & findable within orgs) inside locked down "folders", there is no way to make a "folder"'s access recurse, if you find out that a "folder" had the wrong access rights it's absolute hell to fix it.

kartickv 8y ago
Or get a list of documents sorted by access level or the person you've shared it with. Like a CA you hired 3 years ago to file your taxes no longer needs access to your financial information.

driverdan 8y ago

All of AWS' access control is too confusing. Unless you spend a lot of time managing AWS it's hard to remember how to configure IAM and ACLs. I have to read the docs almost every time I change something just to be sure I don't screw it up. At my last job our team actively avoided touching IAM as much as possible because we all hated it.

koboll 8y ago
You can tell how old a service is by its name. Most of the old ones have cutesy in-joke names. Most of the new ones are named exactly for what they do. They realized having 400 cutesy joke names was exhausting.
- rmwaite 8y ago
  How is IAM a cutesy name?
  - denisw 8y ago
    It can be read as both an acronym for “Identity and Access Management” and as the phrase “I am”, which also happens to fit the topic of identity.
    - yread 8y ago
      err it's the same in google cloud
    - arbie 8y ago
      Never noticed this before, and now can never unsee it. Thank you.
    - morpheuskafka 8y ago
      True, but that would apply to everyone else that uses the acronym, not something Amazon invented.
- lclarkmichalek 8y ago

Alex3917 8y ago

Great changes! But, there should also be an account-wide option just to ban public uploads to a bucket. For anyone running a website, checking any of these 'recommended' boxes is going to take down prod. (I just started checking boxes impulsively to see what would happen; fortunately any changes revert quickly!)

scarface74 8y ago
I would go so far as to put public S3 buckets for websites into a separate account.

ZWoz 8y ago

"Too confusing" can be feature though. Older Microsoft strategy, now you have good ground for integrators and value added resellers. Guys, who know specific platform,so they sell it and promote it for every chance.

deleted 8y ago

[deleted]

scarface74 8y ago

You’ve never had to figure out how to make your buckets private. They are private by default. This new feature adds another level of protection against making a bucket public. Making a bucket public is a very simple understandable option in the interface. The screenshots were just there to illustrate how even if the bucket is public the new feature will block it on the account level. Comparing Google Drive to S3 is not really valid. No one is using Google Drive as an enterprise level access storage solution that can serve millions of requests.

vhold 8y ago
The problem is really that sharing securely is way too complicated. So inexperienced or lazy people give up and make the bucket public so they can get on with whatever it was they were trying to accomplish.
- scarface74 8y ago
  They shouldn’t be able to access AWS if they don’t know what they are doing. Alternatively, the admins should set up of a simple CloudTrail rule to alert them. Being “in the cloud” doesn’t abrogate your responsible for security governance and monitoring.

INTPenis 8y ago

So true. I just started AWS development and sure I managed to trudge through it carefully and make sure my buckets had the correct policy. But I can totally understand how a lot of people are making mistakes. AWS is very overwhelming even to an experienced Linux admin and programmer. And even with the bucket policy generator you're left reading a lot of documentation to understand what you need to input. Add on top of that a person from a non-english speaking country and it's a recipe for privacy disaster.

scarface74 8y ago
I’m sure Linux administration will be just as overwhelming and confusing to me once I start getting into it as an experienced (20+ years) Microsoft developer who has cut my teeth on all things AWS except for the machine learning parts.... Its all about context.

closeparen 8y ago

Google Drive and AWS are not interchangeable tools. One is for use by end-users, the other by software.

tzhenghao 8y ago

This. I've been using AWS for my side projects, but strongly considered moving to GCP at some point. Sometimes I swear I feel like I need a phd in AWS literature to even set up a box with the "right" permissions for my friends. Sure, I'm no sysadmin, but it's mind blogging that setting up a cloud instance feels harder than doing it all on premise.

jhwang5 8y ago

With that mindset, you have no business using AWS.