Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web.
| Capability ID | Capability Description | Category | Value | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|---|
| aws_s3 | AWS S3 | protect | minimal | T1685.006 | Clear Linux or Mac System Logs |
Comments
When Linux Logs are forwarded off-host through CloudWatch Logs and archived in Amazon S3, S3 Object Lock can preserve copies despite an attacker clearing local logs. This requires configured log forwarding and protected retention.
References
|
| aws_s3 | AWS S3 | protect | minimal | T1685.005 | Clear Windows Event Logs |
Comments
When Windows Event Logs are forwarded off-host through CloudWatch Logs and archived in Amazon S3, S3 Object Lock can preserve copies despite an attacker clearing local logs. This requires configured log forwarding and protected retention.
References
|
| aws_s3 | AWS S3 | protect | significant | T1485 | Data Destruction |
Comments
AWS S3 may protect against data destruction through application of several best practices. Multi-factor authentication can be enabled for delete operations and for changing the versioning state of a bucket. Versioning can be enabled to revert objects to a previous state after malicious destruction or corruption. S3 Object Lock can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely. In addition, S3 Cross Region Replication can be used to replicate S3 buckets to another AWS region for add protection.
References
|
| aws_s3 | AWS S3 | protect | significant | T1530 | Data from Cloud Storage |
Comments
S3 provides full control of access via Identity and Access Management (IAM) policies and with its access control lists (ACLs). The S3 Block Public Access feature allows for policies limiting public access to Amazon S3 resources that are enforced regardless of how the resources are created or associated IAM policies. Server-side encryption can be enabled for data at rest and allows for use of S3-managed keys, AWS Key Management Service managed keys, or customer-provided keys.
References
|