S3 安全基线检查项
访问控制
- 账号级 Block Public Access 全部开启
- 桶策略遵循最小权限，禁止 Principal: "*" 除非确实是公开资源桶
- 跨账号访问用 IAM Role 而不是桶策略直接放通
- VPC Endpoint 策略限制只允许特定 VPC 访问敏感桶
- 预签名 URL 有效期不超过 15 分钟
加密与完整性
- 默认加密开启，敏感数据用 SSE-KMS 而非 SSE-S3
- KMS 密钥策略与桶策略双向约束
- 强制 HTTPS：桶策略拒绝 aws:SecureTransport = false
- 开启版本控制，防止误删与勒索软件覆写
- 合规归档数据启用 Object Lock 合规模式
审计与监控
- CloudTrail 数据事件覆盖敏感桶
- 服务端访问日志写入独立的日志桶
- Macie 扫描识别 PII 与敏感数据分布
- Config 规则持续检测公开访问与加密缺失
- GuardDuty S3 Protection 开启异常访问检测
强制加密与 HTTPS 的桶策略
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyInsecureTransport",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::mushan-sensitive-data",
"arn:aws:s3:::mushan-sensitive-data/*"
],
"Condition": {
"Bool": { "aws:SecureTransport": "false" }
}
},
{
"Sid": "DenyUnencryptedUpload",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::mushan-sensitive-data/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "aws:kms"
}
}
},
{
"Sid": "DenyWrongKmsKey",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::mushan-sensitive-data/*",
"Condition": {
"StringNotEqualsIfExists": {
"s3:x-amz-server-side-encryption-aws-kms-key-id":
"arn:aws:kms:ap-northeast-1:111122223333:key/EXAMPLE-KEY-ID"
}
}
},
{
"Sid": "RestrictToVpcEndpoint",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::mushan-sensitive-data/*",
"Condition": {
"StringNotEquals": { "aws:SourceVpce": "vpce-0abc123def456" },
"Bool": { "aws:PrincipalIsAWSService": "false" }
}
}
]
}Deny 语句优先级最高，即使 IAM 策略给了权限也会被拒绝。上线前一定在测试桶验证，避免锁死自己。
防勒索三件套
版本控制 + MFA Delete + 跨账号复制到独立的备份账号。攻击者即使拿到生产账号权限，也无法删除备份账号里的副本。关键数据再加 Object Lock 合规模式，连 root 都删不掉。