2

I have a general security/privacy question about addons that use Amazon S3 for backup / file storage.

Here's my scenario: I host most of my client sites myself and use my own Amazon S3 account to backup various databases and files. However, when using a number of popular addons, at the S3 configuration stage of the setup you enter the authentication details and are then able to see all the buckets in that account.

This of course means that any Super Admin of any one of these sites potentially has access to buckets belonging to other clients. See the security/privacy issue?

Does anyone know a workaround for this, other than each client having their own S3 account?

Cheers

Jim

2

I believe what you're looking for is different access permissions for the same bucket. If that's correct, you might want to take a look at the AWS Identity and Access Management (IAM). I've never used it but it does appear to offer what you're after.

That said, with Backup Pro, you can't actually see anything on S3 from within the module so there's no security issue there. The only files that get displayed are those that are mirrored locally on the server. </shameless>

5
  • Jim has a good point though. If the client can find your S3 access credentials (eg you gave them super admin, or you gave them template edit privileges and they use an escalation of privileges exploit) they have access to your whole S3 account. Feb 26 '13 at 6:12
  • I believe that with IAM Jim can setup a sandboxed credential set which only has access to the buckets intended. I think...
    – Eric Lamb
    Feb 26 '13 at 6:37
  • This looks great Eric and is something I'm going to check out right away. Don't worry about your shameless plug - I'm already a happy customer! Feb 26 '13 at 9:38
  • You could create a member group with access to everything except that module. So it would be like a Super Admin group but with that one restriction.
    – glider
    Feb 27 '13 at 1:03
  • FWIW, with Backup Pro in order to even see the settings you have to either be Super Admin or a special member group that is assigned through the Backup Pro settings.
    – Eric Lamb
    Feb 27 '13 at 5:19
0

Here's the full info to help.

  1. Set up a new bucket for the client
  2. Set up a new user in IAM with a set of access keys but no password, thus can't login to AWS control panel.
  3. Under the Permissions tab for this new user attach a user policy as below. Be sure to enter bucket name.
{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Allow",
        "Action": "s3:ListAllMyBuckets",
        "Resource": "arn:aws:s3:::*"
    },
    {
      "Sid": "Stmt1395087711000",
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::<bucket-name>",
        "arn:aws:s3:::<bucket-name>/*"
      ]
    }
  ]
}

Now you can use the key and private key to access the bucket in addons or via S3 tools. You can also adjust permissions to allow only PUTting of files and no viewing/deletion, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.