- [Rudy] So, we've swarmed you with mentions of Amazon S3 throughout this course, but how does one secure S3? Well, you'd want to consider things like only allowing bucket access to authorized parties. And if you don't need public access, make sure it's disabled for a bucket. Or, maybe you want to add encryption to the equation. But wait, what is S3 again, and what's a bucket, and how do we prevent them from having holes? Simply put, Amazon S3 is cloud storage for the internet. And, think of a bucket as a literal bucket, where you can add, remove, or update objects. To upload your data, whether they be photos, videos, documents, you first create a bucket in one of the AWS Regions, and then, you can upload objects to it. But, we're talking about securing those objects, and the first thing you can do is set up bucket policies. A bucket policy is a resource-based AWS Identity and Access Management policy, which means that you designate access permissions for the bucket and the objects in it. So if you want a user to be able to read from a bucket, then you provision the relevant policy. Going even more fine-grained, you can dictate permissions for individual objects. But as a best practice for managing a whole bucket, we recommend enabling default encryption on the bucket itself. This means that all objects in that bucket will be encrypted, and that encryption can be centrally managed at the bucket level. Objects will be encrypted using server-side encryption with either Amazon S3 managed keys, that's SSE-S3, or AWS KMS, or Key Management Service managed keys, SSE-KMS. Also, it should be noted that you do not incur extra charges for using default encryption for your S3 buckets, but you will be charged for the encryption keys themselves. For more information on the different encryption options and pricing for key storage, please check out our Resources section. The last service we'll cover is called Amazon Macie, which is for those of you who like the managed option of securing your S3 buckets. Well, managed in the sense that Macie uses machine learning to automatically discover, classify, and protect sensitive data in AWS. That means Amazon Macie will automatically recognize your sensitive data, such as personally identifiable information, or PII, even intellectual property, your IP, maybe even honeycombs! You'll then be provided with alerts on areas of interest, along with a dashboard giving you insights into how your data is being accessed, moved, and modified. Some of the things that Macie checks for are inadvertent exposure of data, insider threats, and targeted attacks. You can then alert on suspicious activity, such as compromised user accounts and downloading of large amounts of sensitive content from unusual IP addresses, or maybe the download of a large quantity of source code by a user account that typically does not access this type of sensitive content. I mean, we don't want our secret honey formula stolen. For a full list of Macie's features, please check out our Resources section. Thanks for following along and learning how to secure your Simple Storage Service, or S3. It's been fun and hope you enjoy our upcoming videos.