5 ms·
I still don't get the s3 breach issue. I mean, buckets are private by default. Why would anyone take any action to open an s3 bucket that stores logs? If you do
by figassis 4y ago
I still don't get the s3 breach issue. I mean, buckets are private by default. Why would anyone take any action to open an s3 bucket that stores logs? If you do nothing you're already halfway there. Or is there a failure mode that I'm not aware of?
- zo1 4y agoMy take: S3 buckets have an "air" or "impression" of being easy to "host" publicly available "things". It's even one of their selling points, IIRC. I.e. hosting a PWA/index.html website on a bucket.
- dragonwriter 4y agoI'm guessing that there are lots of (public and internal) tools, documented workflows, etc., dealing with S3 buckets that implement very bad security defaults because it streamlines getting something apparently functional and working on it in a dev environment, even though AWS itself has secure defaults, and using those easy-for-dev approaches with live PII of otherwise critical data is a recipe for disaster. People often aren’t starting with the AWS defaults, they are starting with an IaC (Cloud formation, CDK, Terraform) template they got from some other project.
- paranoidrobot 4y agoI don't know about this specific case, but sometimes trying to get log delivery from AWS services has been finicky and annoying to set up correctly. Different Account IDs for regions and products. There's also some configurations that require you to open access to the S3 bucket to get Cloudfront to point at it, because their Origin Access ID configuration doesn't work for all scenarios. I know some of these things were sorted, but I don't have access to the old configurations to prompt me to remember what they are.