Bug-Byte #5: Unlocking AWS S3: Overcome Access Denied with Insider Tips

Troubleshooting access to S3 buckets in AWS can be frustrating at times, especially given the generic nature of AWS Access Denied errors. These errors often stem from misconfigured policies on the S3 bucket or IAM principal. However, I have encountered a few more exotic cases in the field.

On the rare occasion that the issue is not policy-related, there are three places that I like to check:

1. Does the bucket have server-side encryption (SSE) configured with a customer-managed KMS Key (CMK)?
2. Does the traffic to the S3 bucket pass through any VPC S3 endpoints?
3. Are you trying to configure a Public S3 bucket when all public access is blocked at the account level?

Server-Side Encryption

If an S3 bucket is configured with SSE and is using a CMK, make sure that the principals who require access to the bucket have been granted the ability to use the following actions in the KMS key policy:

How to Save Big on Big Data in AWS

Is your S3 data accumulating and costing more than you would like? Cloud storage has a way of creeping upward, especially as applications become hungrier for data. Thankfully, if you’re just noticing this issue there’s a good chance you can leverage lifecycle policies to manage your data in a more sustainable way. One of our customers saw a 70% reduction in daily S3 costs after implementing appropriate lifecycle policies for their S3 data.

AWS Config: Deploying across Multiple AWS Accounts, Regions, and Organizations

Deploying AWS Config Across Multiple AWS Organizations, Accounts and Regions

One of our AWS Managed Services customers has a multi-AWS Organization account structure - three Organizations in total.

While not a common deployment strategy, in this particular case it satisfied the client’s specific charge-backup requirements for the various geographical regions where the client operates.

Since resources exist in several AWS Organizations and multiple AWS accounts, we needed a simple way to provide a ‘compliance’ dashboard.

Ensuring Continuous Compliance with AWS Config

Monitoring for Compliance using AWS Config

Recently, a large Canadian manufacturer asked us to help them design and implement a compliance monitoring solution that needed to monitor resources across twelve AWS accounts.

We met the customer’s requirements by deploying AWS Config in a centralized account and setting up the aggregation of resource data into a single AWS account.

Deployment Strategy

In order to consolidate all AWS Config data into a single AWS account, we deployed an AWS Aggregator into one account. After deploying the Aggregator, we authorized the aggregation of data into the central account.