How to Improve Security with AWS S3 and Signed URLs

I was recently engaged by a fintech company to boost the security of their customer file upload process, to succeed their existing setup. The company needed a solution that was both secure and efficient, without disrupting the user experience. Here’s how we approached the challenge and why we ultimately chose AWS S3 and signed URLs. To understand more broadly why this matters, see our guide on cloud security best practices.

The fintech client had a web application allowing customers to upload sensitive documents, such as identification proofs and financial statements. However, the existing setup was not as robust as it could be, introducing the possibility of unauthorised access. This was a critical issue that needed addressing urgently.

Reviewing the options

Before settling on AWS S3 and signed URLs, we explored several other options. One potential solution was enhancing the existing local server storage. While this might have worked initially, it also had significant drawbacks. Scaling local server storage as the number of uploads grew would become increasingly complex and costly. It’s also vital to prevent common cloud misconfigurations to ensure complete security when using services like AWS.

Additionally, maintaining local storage, including backups and redundancy, required continuous effort and resources. There were also inherent security risks, such as vulnerability to physical breaches, that couldn’t be ignored.

Another alternative we considered was using a Content Delivery Network (CDN). A CDN could handle file uploads and serve them to users. However, this approach had its own set of limitations. Integrating a CDN for secure file uploads added complexity to the system, requiring additional configuration and management. The cost could also become prohibitive with a high volume of uploads and downloads. While CDNs offer some security features, they are primarily designed for content delivery rather than secure storage.

AWS S3 and signed URLs

After evaluating these alternatives, we concluded that AWS S3 with signed URLs was the best fit for the fintech company’s needs. S3 provides robust AWS security features, including server-side encryption, IAM roles and policies, and fine-grained access controls. However, it’s essential to be aware of common AWS security issues to effectively utilise these protections. With signed URLs, we could generate temporary, secure links for file uploads, ensuring only authorised users could access the files. Managing access carefully also helps reduce risks of shadow IT in cloud environments.

We began by setting up an S3 bucket to store the uploaded files. We configured the bucket with encryption, versioning, and access control settings to ensure security and reliability. Next, we established Identity and Access Management (IAM) policies and roles to control access to the S3 bucket. By applying the principle of least privilege, we ensured that the role had only the necessary permissions to generate signed URLs and upload files.

Generating signed URLs was a critical component of our solution. We developed a backend API using AWS Lambda and API Gateway to handle this task. When a customer initiated a file upload, the web application would send a request to our backend API. The Lambda function then generated a pre-signed URL using the AWS SDK, with specific permissions for uploading or accessing the file, and an expiration time to enhance security. This signed URL was then returned to the web application, allowing the customer to upload the file directly to the S3 bucket without passing through the application server. This direct upload reduced server load and improved performance, allowing the web application to focus on other tasks more efficiently.

Security doesn’t end with implementation, so we enabled monitoring and logging using S3 server access logging and AWS CloudTrail to keep an eye on bucket activity and detect any anomalies. This continuous monitoring allowed us to respond promptly to potential threats and ensure that the system remained secure.

The business benefit

By adopting AWS S3 and signed URLs, the fintech company gained several business benefits. The enhanced security provided by signed URLs and S3’s built-in features protected customer files from unauthorised access.

The direct uploads to S3 reduced the load on application servers, resulting in better performance and a smoother user experience. S3’s scalability allowed the company to handle growing data volumes without worrying about storage limitations.

The pay-as-you-go pricing model and various storage classes helped the company manage costs effectively. And perhaps most importantly, the reliability and durability of S3 gave the company peace of mind, knowing their customer data was secure and accessible.

If you’re scaling your business, explore our comprehensive cloud adoption strategy for startups to secure and streamline your growth.

The decision to implement AWS S3 and signed URLs provided a robust, scalable, and cost-effective solution for enhancing customer file upload security. This approach not only addressed the immediate vulnerabilities but also positioned the fintech company for future growth and success.

I highly recommend regular reviews and updates to security practices to stay ahead of potential threats. Implementing AWS S3 and signed URLs was a significant step forward, but continuous vigilance and improvement are key to maintaining a secure environment. As a cloud security consultant, I can help you implement AWS best practices.