Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Support able to access any S3 object due to permission change

twitter.com

Post reply on HN
Print view View original

41–50 of 134 posts

Re: AWS Support able to access any S3 object due to permission change

#41

Post by helsinkiandrew »

luckylion wrote: post #27
aborsy wrote: post #22

I have been looking into this lately for a company that wanted to host important data on AWS S3. I couldn’t find conclusive information in public domain. It’s hard to decipher the AWS Data Privacy policy: https://aws.amazon.com/compliance/data-privacy-faq/ In section Who Owns Customer Content, it’s implied that AWS doesn’t access customers’ data: “As a customer, you maintain ownership of your content, and you select…

> AWS doesn’t access customers’ data Amazon's product people also don't look at third party seller statistics to decide which products to sell themselves. Until they got caught doing just that. To assume that they don't look at data feels naive. A German super market chain with online ambitions has a rule that nothing touching their pipeline can be hosted on AWS. Want to sell them SaaS? You can't run your nodes on AW…

Are you referring to third party seller sales on the amazon.com websites?

That's completely different and separate issue from AWS customer data (for example someone running e-commerce software on a linux VM).

3rd party seller sales pay Amazon commission on each sale - deciding which products are selling well is just a matter of Amazon doing a SQL call on their own sales database (much like a physical retailer may see what brands/products are selling well)

Re: AWS Support able to access any S3 object due to permission change

#43

Post by gonzo41 »

helsinkiandrew wrote: post #39

I'm not sure what the hoo hah is about. All that's changed is that this role is now visible in IAMS and any API calls by Amazon support tools will be logged in AWS CloudTrail - I don't think AWS have any more access now than they did before. It's obvious to anyone who has had problems with any AWS services (lambda functions that couldn't be deleted, non properly propagating/operational services) that support has acce…

But can it override and explicit wildcard deny modification policy in a Bucket!

Re: AWS Support able to access any S3 object due to permission change

#44

Post by Lorkki »

twosugars wrote: post #21

When I worked in aws, this is primarily used to check for permissions of an object. I know how dumb customers can be, for the most part this is used to see why a customer cannot delete a bucket or object those sort of things. I don't remember having ability to see actual customers data only metadata is accessible. Edit: Based on what I know, I'm pretty sure support will not be able see any of the customers data.

> I know how dumb customers can be

Maybe a more constructive way to look at this would be that people simply do "dumb" things. In customer support where you only see those moments, it might not always seem that way, but dealing with people's simple mistakes is also educating them to do better next time.

Re: AWS Support able to access any S3 object due to permission change

#45

Post by L0g4n »

Such concerns specifically led to my decision of only uploading sensitive data to S3 with client side encryption. Since the aws cli tool only supports server side encryption with keys stored on amazon servers (where the non-default managed keys cost like 1 USD per month), I decided to simply symmetrically encrypt the backup of my syncthing data volume with AES256 using gnupg and only then pushing it to the S3 bucket.

Re: AWS Support able to access any S3 object due to permission change

#46

Post by lvs »

helsinkiandrew wrote: post #41
luckylion wrote: post #27

Earlier quoted context omitted.

> AWS doesn’t access customers’ data Amazon's product people also don't look at third party seller statistics to decide which products to sell themselves. Until they got caught doing just that. To assume that they don't look at data feels naive. A German super market chain with online ambitions has a rule that nothing touching their pipeline can be hosted on AWS. Want to sell them SaaS? You can't run your nodes on AW…

Are you referring to third party seller sales on the amazon.com websites? That's completely different and separate issue from AWS customer data (for example someone running e-commerce software on a linux VM). 3rd party seller sales pay Amazon commission on each sale - deciding which products are selling well is just a matter of Amazon doing a SQL call on their own sales database (much like a physical retailer may see…

(S)he's just saying that Amazon's claims about their business practices can't be audited by anyone and are therefore unenforceable except by lawsuit on a timescale of years.

Re: AWS Support able to access any S3 object due to permission change

#48

Post by twosugars »

fivea wrote: post #36
twosugars wrote: post #21

When I worked in aws, this is primarily used to check for permissions of an object. I know how dumb customers can be, for the most part this is used to see why a customer cannot delete a bucket or object those sort of things. I don't remember having ability to see actual customers data only metadata is accessible. Edit: Based on what I know, I'm pretty sure support will not be able see any of the customers data.

> I know how dumb customers can be (...) This sort of personal attack is unwarranted and extremely unfair. AWS is renowned for it's byzantine and ever-changing and expanding nature, to the point it's outright practically impossible to know extremely basic things such as what are you paying for and how much you are paying.

Not a personal attack definitely.

Re: AWS Support able to access any S3 object due to permission change

#49

Post by jcims »

ptcrash wrote: post #9

Okay, opinions up front: I don't think this is worthy of "declaring a security incident. Having some experience working behind the scenes, just because this policy was changes this way doesn't mean "All AWS Support personnel had unrequited access to your S3 objects." To me, this reads as Twitter inflammatory nonsense. Here's why: * KMS Encrypted objects would not be accessible because the support personnel would need…

> * KMS Encrypted objects would not be accessible because the support personnel would need permission policies that grant `kms:decrypot` permissions to encrypted objects.

This is only true if you are using SSE-KMS *and* are creating/managing the CMKs used to encrypt objects. If you’re using SSE-S3 or SSE-KMS with the default AWS S3 key (aws/s3) there is no key policy to manage.

Of course SSE-C or 100% customer-managed crypto would be immune as well, but under different mechanics.

> Objects with a default-deny bucket policy could not have been circumvented with the support team's escalated privilege.

I would wager this is done for a vanishingly small percentage of buckets used in production. Less than one percent for sure.

The general point you’re making seems to be that if you had a comprehensive, defense-in-depth security strategy for your cloud computing environment then this would have had no effect, and i do agree with that. I just think that in reality this would have provided access to wide swaths of customer data.

Re: AWS Support able to access any S3 object due to permission change

#50

Post by KaiserPro »

trzmiel4 wrote: post #24
twosugars wrote: post #21

When I worked in aws, this is primarily used to check for permissions of an object. I know how dumb customers can be, for the most part this is used to see why a customer cannot delete a bucket or object those sort of things. I don't remember having ability to see actual customers data only metadata is accessible. Edit: Based on what I know, I'm pretty sure support will not be able see any of the customers data.

> I know how dumb customers can be I find this insulting as a customer. Is AWS usually contemptuous of its customers? I don't think I've ever called my customer "dumb", and working as a consultant I've seen all kinds of interesting things. People make mistakes. They're always in a hurry. They may have a hard time understanding ambiguous, complex or incomplete documentation. The interface may be confusing and lead the…

I am not an expert in AWS, but I have been using it for far too many years and am intimate with a number of workarounds for common problems(fuck you cloudformation).

But, I have sent off helpdesk requests for things that turn out to be me being very stupid.

Post reply on HN