AWS AmazonS3 medium security documentation change
Summary
Added guidance to avoid sensitive information in bucket names, updated uniqueness and region selection notes, and adjusted related links
Security assessment
Explicitly warns against including sensitive information in bucket names due to URL visibility, which addresses potential information exposure risks
Diff
diff --git a/AmazonS3/latest/userguide/bucketnamingrules.md b/AmazonS3/latest/userguide/bucketnamingrules.md index 097f58c7b..44b952a56 100644 --- a/AmazonS3/latest/userguide/bucketnamingrules.md +++ b/AmazonS3/latest/userguide/bucketnamingrules.md @@ -9 +9 @@ General purpose buckets naming rulesExample general purpose bucket namesBest pra -When you create a general purpose bucket, you choose its name and the AWS Region to create it in. After you create a general purpose bucket, you can't change its name or Region. The following sections provide information about general purpose bucket naming, including naming rules, best practices, and an example for creating a general purpose bucket with a name that includes a globally unique identifier (GUID). +When you create a general purpose bucket, make sure that you consider the length, valid characters, formatting, and uniqueness of bucket names. The following sections provide information about general purpose bucket naming, including naming rules, best practices, and an example for creating a general purpose bucket with a name that includes a globally unique identifier (GUID). @@ -11 +11 @@ When you create a general purpose bucket, you choose its name and the AWS Region -For directory bucket naming rules, see [Directory bucket naming rules](./directory-bucket-naming-rules.html). +For information about object key names, see [Creating object key names](https://docs.aws.amazon.com/en_us/AmazonS3/latest/userguide/object-keys.html). @@ -13 +13 @@ For directory bucket naming rules, see [Directory bucket naming rules](./directo -For information on object key names, see [Creating object key names](https://docs.aws.amazon.com/en_us/AmazonS3/latest/userguide/object-keys.html). +To create a general purpose bucket, see [Creating a bucket](./create-bucket-overview.html). @@ -63 +63 @@ The following naming rules apply for general purpose buckets. - * Bucket names **must** be unique across all AWS accounts in all the AWS Regions within a partition. A partition is a grouping of Regions. AWS currently has three partitions: `aws` (commercial Regions), `aws-cn` (China Regions), and `aws-us-gov` (AWS GovCloud (US) Regions). + * Bucket names **must** be unique across all AWS accounts in all of the AWS Regions within a partition. A partition is a grouping of Regions. AWS currently has three partitions: `aws` (commercial Regions), `aws-cn` (China Regions), and `aws-us-gov` (AWS GovCloud (US) Regions). @@ -65 +65,5 @@ The following naming rules apply for general purpose buckets. - * A bucket name can't be used by another AWS account in the same partition until the bucket is deleted. **After you delete a bucket, be aware that another AWS account in the same partition can use the same bucket name for a new bucket and can therefore potentially receive requests intended for the deleted bucket.** If you want to prevent this, or if you want to continue to use the same bucket name, don't delete the bucket. We recommend that you empty the bucket and keep it, and instead, block any bucket requests as needed. + * A bucket name can't be used by another AWS account in the same partition until the bucket is deleted. **After you delete a bucket, be aware that another AWS account in the same partition can use the same bucket name for a new bucket and can therefore potentially receive requests intended for the deleted bucket.** If you want to prevent this, or if you want to continue to use the same bucket name, don't delete the bucket. We recommend that you empty the bucket and keep it, and instead, block any bucket requests as needed. For buckets no longer in active use, we recommend emptying the bucket of all objects to minimize costs while retaining the bucket itself. + + * When you create a general purpose bucket, you choose its name and the AWS Region to create it in. After you create a general purpose bucket, you can't change its name or Region. + + * Don't include sensitive information in the bucket name. The bucket name is visible in the URLs that point to the objects in the bucket.