11.1 Data Classification & Amazon S3 Security

11.1 Data Classification & Amazon S3 Security

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to protect sensitive data at scale. You must master data classification schemes, automate sensitive data discovery using Amazon Macie, neutralize accidental data exposure using Amazon S3 Block Public Access (BPA), enforce strict cryptographic controls via S3 bucket policies, and implement scalable access architectures using S3 Access Points.

Enterprise Data Classification Frameworks & Sensitivity Tiers

Information security governance begins with data classification. Cloud environments host disparate workloads ranging from open-source marketing documentation to sensitive personal identifiers. Without clear classification, organizations either over-engineer controls for benign data or under-protect high-value assets. Modern cloud operations classify data into four standardized sensitivity tiers:

1. Public: Information approved for public consumption (e.g., product documentation, marketing assets, public software releases). Unauthorized disclosure carries zero confidentiality risk, though integrity and availability remain vital.
2. Internal: Operational data intended for internal organizational use (e.g., internal wikis, organizational charts, non-sensitive operational telemetry). Unauthorized disclosure causes minor operational disruption or competitive inconvenience.
3. Confidential: Business-critical assets and intellectual property (e.g., proprietary source code, financial projections, vendor contracts, internal audit logs). Unauthorized disclosure causes material financial or legal damage.
4. Restricted: Highly sensitive regulated data (e.g., Personally Identifiable Information [PII], Protected Health Information [PHI] under HIPAA, Payment Card Industry [PCI-DSS] cardholder data, customer banking records, and root credentials). Compromise results in catastrophic regulatory penalties, severe brand damage, and immediate legal liability.

---

Amazon Macie: Automated Sensitive Data Discovery & Protection

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data stored in Amazon S3.

Detection Mechanics & Managed Identifiers

Macie continuously evaluates your Amazon S3 bucket inventory across an AWS Organization. It inspects uncompressed and compressed files (.tar, .gz, .zip), nested archives, and structured formats (.csv, .json, .parquet). Macie detects:

• Personally Identifiable Information (PII): Full names, home addresses, passport numbers, driver's license numbers, national identification numbers (e.g., U.S. Social Security Numbers).
• Financial Data: Credit card primary account numbers (PAN), bank routing numbers, financial account details.
• Security Credentials & Secrets: AWS secret access keys, private cryptographic keys, certificates, authorization tokens.
• Custom Data Identifiers: Organizations define proprietary patterns using regular expressions (regex), proximity keywords (e.g., "EmployeeID" within 30 characters), and character exclusion criteria.

Automated Discovery vs. Targeted Discovery Jobs

Macie provides two operational discovery modes:

• Automated Sensitive Data Discovery: Macie performs continuous, intelligent sampling across all S3 buckets in your account or organization. It builds an interactive sensitive data heat map and calculates sensitivity scores for each bucket without requiring manual job definition.
• Targeted Sensitive Data Discovery Jobs: CloudOps engineers configure targeted, in-depth evaluation jobs against specific buckets, prefixes, or object modification dates. These jobs execute a complete, non-sampled 100% scan of all targeted objects to satisfy compliance audits.

Macie Findings & Event-Driven Remediation

When Macie detects sensitive data or an insecure bucket configuration, it generates detailed findings categorized into two primary types:

• Sensitive Data Findings (SensitiveData:S3Object/...): Identifies the specific object, location, classification tier, and count of sensitive occurrences.
• Policy Findings (Policy:IAMUser/S3BucketPublic): Flags security regressions, such as a bucket becoming publicly accessible or disabling default encryption.

Macie automatically publishes findings to the default Amazon EventBridge event bus within minutes. Operational architectures ingest these events to trigger serverless remediation workflows:

{
  "source": ["aws.macie"],
  "detail-type": ["Macie Finding"],
  "detail": {
    "severity": {
      "description": ["High", "Medium"]
    },
    "type": ["SensitiveData:S3Object/Personal", "Policy:IAMUser/S3BucketPublic"]
  }
}

An EventBridge rule matching this pattern invokes an AWS Lambda function or Systems Manager Automation runbook to immediately apply S3 Block Public Access, attach a restrictive bucket policy, or move the offending object to an isolated quarantine bucket.

---

Amazon S3 Block Public Access (BPA): Four Core Settings

Accidental public exposure of S3 buckets remains one of the most common causes of enterprise data breaches. Amazon S3 Block Public Access (BPA) provides four centralized switches that override all bucket policies, access point policies, and object Access Control Lists (ACLs).

[!IMPORTANT] Account-Level vs. Bucket-Level BPA: While Block Public Access can be applied to individual S3 buckets, CloudOps engineers must enforce Block Public Access at the AWS Account Level. The account-level setting acts as an immutable umbrella: it applies to all existing buckets and automatically protects any new buckets created in the account in the future, regardless of how developers configure local bucket settings.

---

S3 Bucket Policies: Enforcing In-Transit & At-Rest Encryption

Resource-based S3 bucket policies provide deterministic enforcement of cryptographic standards.

Enforcing TLS in Transit (aws:SecureTransport)

To satisfy regulatory standards like PCI-DSS and HIPAA, all communication with S3 must use encrypted HTTPS connections (TLS 1.2+). CloudOps engineers enforce this using an explicit Deny policy evaluated when aws:SecureTransport is false:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnforceTLSRequestsOnly",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::corp-analytics-data",
        "arn:aws:s3:::corp-analytics-data/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Because explicit Deny evaluations override any Allow, any unencrypted HTTP request sent over port 80 is rejected immediately with an HTTP 403 Forbidden error.

Enforcing Server-Side Encryption Headers

While S3 applies SSE-S3 encryption by default, enterprise governance frequently mandates encryption using specific Customer Managed Keys (CMKs) in AWS KMS. Bucket policies enforce this by denying s3:PutObject calls that fail to supply the required KMS encryption headers:

{
  "Sid": "DenyUnencryptedObjectUploads",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::corp-analytics-data/*",
  "Condition": {
    "StringNotEquals": {
      "s3:x-amz-server-side-encryption": "aws:kms"
    }
  }
}

---

S3 Access Points & Multi-Region Access Points (MRAP)

As enterprise data lakes grow to petabyte scale, managing permissions through a single bucket policy becomes unmanageable. S3 bucket policies have a hard size limit of 20 KB, creating an administrative bottleneck when dozens of teams require distinct access patterns.

S3 Access Points

Amazon S3 Access Points decompose monolithic bucket policies into discrete, application-specific entry points:

• Each access point has a unique DNS hostname (e.g., finance-app-ap-111122223333.s3-accesspoint.us-east-1.amazonaws.com).
• Each access point attaches a dedicated IAM resource policy tailored to a specific application, role, or team.
• Network Origin Controls: An access point can be bound exclusively to a specific Virtual Private Cloud (VPC) ID. Any request originating outside that designated private VPC is blocked, guaranteeing that internal data remains inaccessible from the public internet.

S3 Multi-Region Access Points (MRAP)

S3 Multi-Region Access Points (MRAP) provide a single global endpoint (e.g., my-global-mrap.accesspoint.s3-global.amazonaws.com) that routes client requests across multiple S3 buckets in different AWS Regions:

• Built on AWS Global Accelerator: MRAP automatically routes client requests over the AWS private global network backbone to the closest operational S3 bucket with the lowest network latency.
• Active-Active and Active-Passive Failover: Operators configure routing controls to shift 100% of read and write traffic away from an impaired AWS Region to a standby Region in minutes.
• Cross-Region Replication Synchronization: Pairs seamlessly with S3 Cross-Region Replication (CRR) to maintain synchronized, highly available global datasets.