3 ms·
While I recognize that's the ideal goal, and most appropriate, I think there may be gaps in practice. My team just discovered yesterday that a Kinesis Firehose
by alpha_squared 5y ago
While I recognize that's the ideal goal, and most appropriate, I think there may be gaps in practice. My team just discovered yesterday that a Kinesis Firehose Stream can still deliver to an S3 bucket that lacks a bucket policy and whose ACLs disable any access to it at all. That diminished my confidence a little bit that all teams are perfectly in compliance of the overall goal.
- schlarpc 5y agoKinesis Firehose uses an IAM role to deliver data, so delivery within the same account does not necessarily depend on permissions on the bucket. Removing s3:* permissions from that IAM role or adding an explicit deny statement to the bucket policy would stop the flow of data. https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-s3 https://docs.aws.amazon.com/firehose/latest/dev/controlling-... https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...
- orf 5y agoNo it can’t. The role you assigned to firehose has permission to write to the bucket.
- tempnow987 5y agoCan you post the permissions for the IAM role, we could probably help you troubleshoot. I've NEVER heard of anything even close to this ever.