Data breaches from S3 buckets

Over the last few years there have been a large number of data breaches from S3 buckets, for example:

• Dow Jones, records from 2.2 million users
• FedEx - 120,000 user records including scanned driver licenses 
• Security researcher finds 2,000 public S3 buckets thought to be misconfigured
• Uber - 57 million user and driver records stolen

S3 is the storage service provided by Amazon - but there is nothing intrinsically insecure about S3. AWS provides the ability to configure S3 very securely - but equally it's possible to misconfigure S3 and make buckets or objects public when they should be private. The same applies to storage services from other cloud providers. 

Some of the data breaches were simply due to the S3 bucket being configured as public instead of private. AWS improved the S3 console recently, to clearly warn the user when a bucket or object is being made public. But I know some DevOps engineers who only ever use code and never log in to the console - so they would never see these warnings.

The Dow Jones case I find interesting because the misconfiguration arose from the use of "authenticated users" in the access control list. You might think that means an authenticated user of the same AWS account the S3 bucket resides in. Actually it means any AWS account in the world.

The Uber S3 bucket wasn't misconfigured as such - it appears that an attacker got hold of GitHub credentials, so could access private Git repositories, the attacker then discovered an AWS key which had rights to the S3 bucket.

Effectively protecting an organisation against cloud security incidents such as these requires an in-depth understanding of cloud security architecture, security expertise relating to cloud provider services, combined with a DevSecOps approach to infrastructure code development, testing and deployment.

---