Cloud Storage Security: AWS S3 & GCP GCS Encryption
Cloud storage buckets (AWS S3 and GCP Cloud Storage / GCS) store enterprise intellectual property, application back-ups, database dumps, and sensitive PII. Unencrypted storage buckets or misconfigured IAM policies remain leading causes of high-profile enterprise data breaches. Relying solely on default cloud-provider encryption (SSE-S3 / SSE-GCS) leaves data vulnerable to internal privilege escalation attacks or credential compromise.
Enterprise Cloud Storage Security combines Envelope Encryption, Customer-Managed Encryption Keys (CMEK / CMK) via AWS KMS or GCP KMS, strict IAM least-privilege policies, VPC Gateway Endpoints, and Object Lock (WORM retention). This guide details server-side vs client-side encryption, KMS key rotation policies, private network endpoints, and compliance lock enforcement.
Mental Model: Server-Side Encryption (SSE-S3/SSE-KMS) vs Client-Side Envelope Encryption
Encryption at rest protects data against physical media theft or unauthorized storage access. However, different encryption models govern key lifecycle ownership:
1. SSE-S3 / SSE-GCS (Default Provider Managed): Cloud provider manages all master keys transparently. Does not offer audit log visibility or custom key rotation schedules. 2. SSE-KMS / CMEK (Customer Managed): Data objects are encrypted using a unique Data Encryption Key (DEK). The DEK is encrypted using a master Key Encryption Key (KEK) managed in AWS KMS or GCP KMS. For secret management best practices, review securing cloud native applications ebpf cilium tetragon and implementing zero trust network architecture with Tailscale.
Quick reference
- Envelope encryption encrypts object data with a unique DEK, wrapping the DEK with a KMS KEK.
- KMS Audit Logs (AWS CloudTrail / GCP Audit Logs) track every encryption/decryption request.
- Customer Managed Keys (CMK) allow immediate revocation of data access by disabling the KMS key.
- Client-side encryption encrypts data payload before transmitting across network sockets.
- Protects corporate data assets against insider threat and cloud credential theft.
Remember this
Enforce KMS Customer-Managed Encryption Keys (CMEK) to retain audit logging and access revocation control.
AWS KMS Customer Managed Keys (CMK) & GCP KMS Key Rotation
Configuring buckets to mandate Customer Managed Keys is enforced via bucket policies:
1// AWS S3 Bucket Policy - Deny Unencrypted Uploads2{3 "Version": "2012-10-17",4 "Statement": [{5 "Sid": "DenyUnEncryptedObjectUploads",6 "Effect": "Deny",7 "Principal": "*",8 "Action": "s3:PutObject",9 "Resource": "arn:aws:s3:::corporate-finance-data/*",10 "Condition": {11 "StringNotEquals": {12 "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/my-cmk-key-id"13 }14 }15 }]16}Quick reference
- Bucket policies enforce SSE-KMS headers on all incoming PUT requests, blocking unencrypted uploads.
- Automatic annual KMS key rotation generates new key versions without requiring re-encrypting existing objects.
- KMS key policies grant explicit crypto permissions (kms:GenerateDataKey, kms:Decrypt) per IAM role.
- Separates storage bucket administration permissions from cryptographic key decryption rights.
- Satisfies SOC2, HIPAA, and PCI-DSS compliance encryption controls.
Remember this
Attach IAM policies requiring explicit KMS CMK encryption keys on object creation.
Preventing Data Exfiltration with Bucket Policies, VPC Endpoints, & Private Service Connect
Exposing S3 or GCS buckets to public internet endpoints increases attack surfaces. Private Network Routing routes storage traffic through internal cloud backbones:
- AWS S3 VPC Endpoints (Gateway / Interface): Bypasses public internet gateways entirely, allowing application EC2 instances / EKS pods in private subnets to read/write storage over AWS private fiber. - GCP Private Service Connect (PSC): Routes GCS traffic through private IP addresses inside internal VPC networks.
Quick reference
- VPC Endpoints isolate storage bucket traffic within private cloud network backbones.
- VPC Endpoint policies restrict bucket access exclusively to specific VPC IDs and IP ranges.
- Disables public access blocks (BlockPublicAccess) at the AWS account level globally.
- Prevents data exfiltration by blocking object downloads outside corporate network boundaries.
- Delivers zero-trust network boundary security for cloud object storage.
Remember this
Route all cloud storage traffic over private VPC Endpoints to block public internet access.
Object Lock, WORM Compliance, & Versioning Retention Policies
Ransomware attacks frequently target cloud backups by issuing bulk delete operations. S3 Object Lock and GCS Bucket Lock implement WORM (Write Once, Read Many) protection:
1. Compliance Mode: Prevents any user (including the AWS root account) from deleting or overwriting locked object versions until the retention period expires. 2. Governance Mode: Protects objects from deletion while allowing administrative IAM users with special permissions to alter retention settings during emergency maintenance.
Quick reference
- WORM compliance lock blocks object deletion and modification even by root accounts.
- S3 Object Lock protects database backups from ransomware deletion attacks.
- Object Versioning retains historical object states when overwrites occur.
- Lifecycle policies transition aged objects to Glacier Deep Archive for long-term storage.
- Ensures SEC Rule 17a-4 and FINRA regulatory compliance for financial records.
Remember this
Enable S3 Object Lock Compliance Mode to protect mission-critical backups from ransomware deletion.
Key takeaway
To test S3 encryption locally, run aws s3api put-bucket-encryption --bucket my-secure-bucket --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms"}}]}'.
Related Articles
Explore this topic