Amazon S3 Security Architecture
Mastering the trifecta of data protection: Bucket Policies, Access Points, and Object Lock (WORM).
Bucket Policies
Resource-based JSON policies that define WHO can access WHAT actions on your bucket.
- Cross-account access
- Enforce HTTPS-only connections
- Restrict to specific VPC Endpoints
Access Points
Unique hostnames that simplify data access for shared datasets at scale.
- Decoupled policy management
- Specific prefix-level isolation
- VPC-only network routing
Object Lock (WORM)
Ensures objects cannot be deleted or overwritten for a fixed amount of time.
- Write Once, Read Many
- Compliance vs Governance modes
- Legal Hold protection
The Security Evaluation Journey
How S3 processes an incoming request through the security layers.
Step 1: Access Point
The request hits the specific Access Point. If the AP policy denies it, the request is blocked immediately.
Step 2: Bucket Policy
S3 evaluates the global Bucket Policy. Any explicit ‘Deny’ here overrides any ‘Allow’ elsewhere.
Step 3: Object Lock
If the action is ‘Delete’, S3 checks if the object is under a retention period or legal hold.