AWS - S3 Persistence
S3
For more information check:
pageAWS - S3, Athena & Glacier EnumKMS Client-Side Encryption
When the encryption process is done the user will use the KMS API to generate a new key (aws kms generate-data-key) and he will store the generated encrypted key inside the metadata of the file (python code example) so when the decrypting occur it can decrypt it using KMS again:
Therefore, and attacker could get this key from the metadata and decrypt with KMS (aws kms decrypt) to obtain the key used to encrypt the information. This way the attacker will have the encryption key and if that key is reused to encrypt other files he will be able to use it.
Using S3 ACLs
Although usually ACLs of buckets are disabled, an attacker with enough privileges could abuse them (if enabled or if the attacker can enable them) to keep access to the S3 bucket.
Last updated
