I'm starting to think we should just not allow developers to use s3 anymore. Despite Amazon plastering it with warnings, these breaches keep happening.
That or we need to start fining heavily for breaches.
That or we need to start fining heavily for breaches.
I don't know that the alternatives would be much better. People have inadvertently made folders on Apache wide open for decades now.
AWS does more than average to combat it, I'd say. E-mail notifications, default configs, scary warnings, etc.
For static sites or other public access required files setting up cloudfront with an authenticated origin pull is pretty straightforward and in our case we use a terraform module to provision and secure the bucket/distribution. I think this come when you get dev/biz users with console access who are trying to "just get it done" when you are dealing with highly confidential or sensitive data, it's a recipe for leak.
People often aren’t starting with the AWS defaults, they are starting with an IaC (Cloud formation, CDK, Terraform) template they got from some other project.
There's also some configurations that require you to open access to the S3 bucket to get Cloudfront to point at it, because their Origin Access ID configuration doesn't work for all scenarios.
I know some of these things were sorted, but I don't have access to the old configurations to prompt me to remember what they are.
But that would probably destroy the onboarding experience, how many tech firms release big products that should have authentication but really don't because of "ease of use"?
(Here's looking at you, ElasticSearch. Did they finally fix this?)
Like, what more can AWS do? Require a blood sacrifice? Call your boss?
So within the org I am part of it is actually absolutely clear what the basic security configuration is. But it is also such a hassle, that I at least (being a data analyst sometimes in need of a short one off project for testing) just don't use it anymore for anything ephemeral (living few days at most) without containing any real world data.
Securing the AWS instance would more often than not actually take nearly as much time as setting up a proof of concept project for a demo itself. More often than not that is only replicating an existing poc and changing a few images, fonts and a bit of text to make it look more like the client's pages/corporate identity.
Then a short demo in a meeting and after that a tear down. Worst case these demos are live for 3 days.
So security as well as compliance add 50 - 100% of effort in these cases. Making POCs on AWS just not worth the effort.
As much as I understand that anything more than a poc needs to be secured I would wish for a way of communicating that some things are just so temporary as to not warrant this overkill. But as this could be abused, there just isn't.
So tl;dr: Orga can ensure security and best practices in AWS if the invest to monitor and check automatically. But that does have other consequences as well.
[Edit] : typos