AWS elasticbeanstalk documentation change
Summary
Updated documentation to state that Elastic Beanstalk now creates encrypted S3 buckets by default and added guidance for enabling EBS encryption
Security assessment
The changes clarify encryption practices (S3 default encryption and EBS encryption guidance) but do not address a specific security vulnerability. This enhances security documentation rather than fixing an existing issue.
Diff
diff --git a/elasticbeanstalk/latest/dg/security-data-protection-encryption.md b/elasticbeanstalk/latest/dg/security-data-protection-encryption.md index b0fae3b90..cc8c77d28 100644 --- a/elasticbeanstalk/latest/dg/security-data-protection-encryption.md +++ b/elasticbeanstalk/latest/dg/security-data-protection-encryption.md @@ -21 +21 @@ To protect your application's data at rest, learn about data protection in the s -Elastic Beanstalk stores various objects in an Amazon Simple Storage Service (Amazon S3) bucket that it creates for each AWS Region in which you create environments. For details, see [Using Elastic Beanstalk with Amazon S3](./AWSHowTo.S3.html). You provide some of the stored objects and send them to Elastic Beanstalk, for example, application versions and source bundles. Elastic Beanstalk generates other objects, for example, log files. In addition to the data that Elastic Beanstalk stores, your application can transfer and/or store data as part of its operation. +Elastic Beanstalk stores various objects in an encrypted Amazon Simple Storage Service (Amazon S3) bucket that it creates for each AWS Region in which you create environments. Because Elastic Beanstalk retains the default encryption provided by Amazon S3, it creates encrypted Amazon S3 buckets. For details, see [Using Elastic Beanstalk with Amazon S3](./AWSHowTo.S3.html). You provide some of the stored objects and send them to Elastic Beanstalk, for example, application versions and source bundles. Elastic Beanstalk generates other objects, for example, log files. In addition to the data that Elastic Beanstalk stores, your application can transfer and/or store data as part of its operation. @@ -23 +23 @@ Elastic Beanstalk stores various objects in an Amazon Simple Storage Service (Am -Elastic Beanstalk doesn't turn on default encryption for the Amazon S3 bucket that it creates. This means that by default, objects are stored unencrypted in the bucket (and are accessible only by users authorized to read the bucket). If your application requires encryption at rest, you can configure your account's buckets for default encryption. For more information, see [Amazon S3 Default Encryption for S3 Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html) in the _Amazon Simple Storage Service User Guide_. +To protect data stored on Amazon Elastic Block Store(Amazon EBS) volumes attached to your environment's instances, enable Amazon EBS encryption by default in your AWS account and Region. When enabled, all new Amazon EBS volumes and their snapshots are automatically encrypted using AWS Key Management Service keys. For more information, see [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) in the _Amazon EBS User Guide_.