Cloud storage (S3): what it is and how it is attacked
A pool of files kept in a cloud platform, each one labelled and fetched by name rather than filed in folders.
Also known as
- S3
- blob storage
- bucket
- object storage
- cloud file storage
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It is where the large, quiet, long-lived copies of things end up, and the folder rules people expect do not apply to it. Access can be granted in several different places at once, so the honest question is not whether it is public but the full list of who can read it.
How it gets attacked, and what reduces it
How it gets attacked
- Read access granted broadly through permissions rather than by making it public
- Links that let anyone holding them fetch the contents, long after they were needed
- Keys for it left in code, in configuration or in a build record
- Reads of the contents not recorded by default, so a copy taken leaves no trace
What reduces it
- Review who can read it through permissions, which is now the common path rather than a public setting
- Expire signed links, and never issue one without an expiry
- Keep its keys out of code, configuration and build records
- Switch on read logging, or a copy taken leaves no trace
Where it sits
- Group
- Storage · Where data sits still.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- object-storage
Reviewed . CC BY 4.0.
Others in storage
- Shared file storeNAS · network attached storageA box on the network that holds shared files.
- Storage networkSAN · storage area networkA high-speed network whose only job is connecting servers to disks.
- Backup vaultimmutable backup · offline backup · air-gapped copyA copy of your data held so that it cannot be changed or deleted for a set period, including by an administrator, for as long as the retention lock is genuinely in force.
The storage group lists all 4 of them side by side.
Cloud storage on your own diagram
Open the editor, press N, and type S3. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker