AWS AWS S3 Capability Group

When Linux Logs are forwarded off-host through CloudWatch Logs and archived in Amazon S3, S3 Object Lock can preserve copies despite an attacker clearing local logs. This requires configured log forwarding and protected retention.

When Windows Event Logs are forwarded off-host through CloudWatch Logs and archived in Amazon S3, S3 Object Lock can preserve copies despite an attacker clearing local logs. This requires configured log forwarding and protected retention.

AWS S3 may protect against data destruction through application of several best practices. Multi-factor authentication can be enabled for delete operations and for changing the versioning state of a bucket. Versioning can be enabled to revert objects to a previous state after malicious destruction or corruption. S3 Object Lock can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely. In addition, S3 Cross Region Replication can be used to replicate S3 buckets to another AWS region for add protection.

S3 provides full control of access via Identity and Access Management (IAM) policies and with its access control lists (ACLs). The S3 Block Public Access feature allows for policies limiting public access to Amazon S3 resources that are enforced regardless of how the resources are created or associated IAM policies. Server-side encryption can be enabled for data at rest and allows for use of S3-managed keys, AWS Key Management Service managed keys, or customer-provided keys.