Preventing S3 Data Exfiltration in AWS: A Defense-in-Depth Story
Data exfiltration is the unauthorized transfer of data from an organization’s systems to an external destination controlled by an attacker. In AWS environments, one of the most common exfiltration vectors involves copying data from company S3 buckets to attacker-controlled ones. It’s deceptively simple, surprisingly effective, and — if you’re not prepared — almost impossible to detect in time. In this article, we’ll walk through a realistic attack scenario step by step, and then close the door on the attacker — one layer at a time....