S3 Upload Security: What Developers Often Get Wrong

Amazon S3 is easy to set up and equally easy to misconfigure. Direct user file uploads introduce major security risks if not properly restricted.

10 S3 Upload Security Flaws to Avoid

1. Public Buckets: Leaving bucket policies open. Always enable Block Public Access at the account level.
2. Trusting Client Content-Type / File Extension: Extensions like invoice.pdf can be manipulated. Perform server-side MIME type detection on byte content.
3. Weak Presigned URLs: Using presigned GET/PUT with long expiry times and no file size constraints. Use presigned POST policies enforcing content-length-range.
4. Missing File Size Restrictions: Malicious users could upload 100 GB files, exhausting your budget.
5. No Malware Scanning: Uploaded files could contain malware. Implement scanning tools like GuardDuty Malware Protection for S3.
6. Predictable Key Paths: Sequential file paths like `uploads/1001.pdf` enable enumeration. Use UUIDs.
7. Serving Uploads from Main Domain: Malicious HTML/SVG uploads executed on your primary domain can steal cookies/tokens. Serve user content from a separate domain (e.g. `user-content.com`).
8. Overly Broad IAM Roles: Granting `s3:*` instead of restricting access to specific buckets and prefixes.
9. Wildcard CORS Policies (`*`): Permitting unauthorized origins to execute cross-site requests.
10. Unencrypted Bucket Storage: Ensure KMS server-side encryption and bucket versioning are enabled.

How does your app validate uploads today?