30.4 Protecting Data: S3, Encryption and Secrets
S3 exposure is the classic cloud leak. Defences:
- Turn on S3 Block Public Access at the account level (S3 console, Block Public Access settings for this account). This overrides mistakes on individual buckets.
- Serve public files through CloudFront with Origin Access Control instead of making the bucket public.
- Use bucket policies that allow only your app role; enable versioning so deleted or ransomed files can be restored.
aws s3api get-public-access-block --bucket reels-media-pune
aws s3api put-public-access-block --bucket reels-media-pune \
--public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
aws s3api put-bucket-versioning --bucket reels-media-pune --versioning-configuration Status=Enabled
Encryption. S3 encrypts new objects by default (SSE-S3). For more control use KMS keys (SSE-KMS): you decide who may use the key, and every use is logged in CloudTrail. Tick "Encryption" when creating RDS and EBS volumes – it cannot be switched on later without a snapshot copy.
Secrets. Database passwords and API keys belong in AWS Secrets Manager or SSM Parameter Store (SecureString), not in config.php committed to Git.
aws ssm put-parameter --name /reels/db/password --type SecureString --value 'Str0ng#Pass'
aws ssm get-parameter --name /reels/db/password --with-decryption --query Parameter.Value --output text
The EC2 role then needs only ssm:GetParameter on that one parameter.
Ravindra Bagale's Tip
Bucket "public" karayche karan nehmi "images disat navhte" asta. Tyacha yogya upay CloudFront + OAC aahe, public bucket nahi. Aani account-level Block Public Access ekda chalu kela ki bhavishyatli chuk pan apoaap thambte.
Lab
Enable account-level Block Public Access. Move the database password of your reels app from config.php into SSM Parameter Store as a SecureString, give the EC2 role permission to read only that parameter, and update the PHP code to fetch it with the AWS SDK.