AWS res medium security documentation change
Summary
Added a note clarifying that an example S3 bucket policy using 's3:*' does not restrict control plane operations, which could allow metadata exfiltration, and suggests adding explicit Deny statements for relevant actions.
Security assessment
The change highlights a security consideration in a data exfiltration prevention policy, warning that S3 control plane actions (like configuring event notifications or replication) could leak object metadata to cross-account destinations. This is a security guidance update to address a potential information disclosure risk.
Diff
diff --git a/res/latest/ug/S3-buckets-preventing-exfiltration.md b/res/latest/ug/S3-buckets-preventing-exfiltration.md index f34c97f9f..2d9c26a74 100644 --- a//res/latest/ug/S3-buckets-preventing-exfiltration.md +++ b//res/latest/ug/S3-buckets-preventing-exfiltration.md @@ -40,0 +41,4 @@ To prevent users from exfiltrating data from secure S3 buckets into their own S3 +###### Note + +This example policy uses `s3:*` and does not restrict S3 control plane operations such as event notification configuration, replication, or inventory. These operations could allow object metadata (such as bucket names and object keys) to be sent to cross-account destinations. If this is a concern, add explicit Deny statements for the relevant S3 control plane actions in the VPC endpoint policy. +