Hacker News Reader

I use Amazon S3 buckets, with the web server having an IAM user key with very limited access that only allows writes.

No reads/listing.

So if the web server gets hacked, the hacker can only write to the bucket, but has no way to know what is already there or access anything in it.

View on HN

Make sure you have versioning turned on as well. Even if attackers can figure out your naming conventions and overwrite, you just go back to the first version and everything is good.

Would be better if there were a “create/write to new file” permission which doesn’t allow overwriting existing files.

Reply on news.ycombinator.com