DEV Community

Aayush Bhadana
Aayush Bhadana

Posted on

How to Secure AWS S3 Buckets Using AWS CLI on Linux: Step-by-Step

#security #aws #cloud #linux

Exposed AWS S3 buckets are one of the most common vectors for cloud data breaches. While the AWS Management Console provides a GUI to configure bucket policies, using the AWS CLI on a Linux environment offers a faster, scriptable, and audit-friendly approach to security hardening.
In this guide, we will walk through restricting public access, enabling server-side encryption, and enforcing HTTPS-only traffic for S3 buckets using the AWS CLI.
Prerequisites
AWS CLI installed and configured with valid IAM credentials.
Basic familiarity with Linux terminal commands and JSON syntax.
Step 1: Block All Public Access
The first line of defense is ensuring public access to your bucket is completely blocked at the bucket level.
Run the following command to apply the PublicAccessBlock configuration:

aws s3api put-public-access-block --bucket your-secure-bucket-name --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
Enter fullscreen mode Exit fullscreen mode

To verify the configuration:

aws s3api get-public-access-block --bucket your-secure-bucket-name
Enter fullscreen mode Exit fullscreen mode

Step 2: Enable Default Server-Side Encryption (SSE-S3)
Encrypting data at rest is critical. You can enforce AES-256 encryption on all newly uploaded objects using this command:

aws s3api put-bucket-encryption --bucket your-secure-bucket-name --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'
Enter fullscreen mode Exit fullscreen mode

Step 3: Enforce HTTPS Transport (SSL Only) via Bucket Policy
To prevent man-in-the-middle (MitM) attacks, configure a bucket policy that denies any unencrypted HTTP requests

(aws:SecureTransport: false)
Enter fullscreen mode Exit fullscreen mode

.
Create a policy with the following JSON structure:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSSLRequestsOnly",
"Effect": "Deny",
"Principal": "",
"Action": "s3:",
"Resource": [
"arn:aws:s3:::your-secure-bucket-name",
"arn:aws:s3:::your-secure-bucket-name/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
Enter fullscreen mode Exit fullscreen mode

Apply the policy using AWS CLI:

aws s3api put-bucket-policy --bucket your-secure-bucket-name --policy file://policy.json
Enter fullscreen mode Exit fullscreen mode

Summary
By automating S3 security hardening via the AWS CLI, you significantly reduce human error and align with AWS cloud security best practices. Integrating these commands into deployment pipelines ensures that infrastructure remains secure by default.

Top comments (0)