AWS S3 보안 가이드 Part 1 AWS S3 Security Guide Part 1

CloudFront 적용을 통한 AWS S3 보안 가이드

AWS S3 보안의 가장 중요한 요소중 하나는 CloudFront 적용을 통한 콘텐츠 보안 유지이다.

CloudFront는 엣지 로케이션이라고 하는 데이터 센터의 전 세계 네트워크를 통해 가장 효율적으로 콘텐츠를 서비스하는 환경을 의미한다. 즉 캐시 서버라고 생각하면 된다.

CloudFront의 보안 기능으로는 Origin Access Identity(OAI) 기능이 있으며, 이는 S3 버킷 및 콘텐츠에 대한 직접 접근을 제한한다. Client로부터 오리진 서버의 직접 접근을 제한하므로 고유한 AWS S3 버킷의 URL(자원) 노출을 막을 수 있다. 또한 CloudFront를 사용함에따라 보다 정교한 보안 설정이 가능하다.

 

 

AWS S3 Security Guide with CloudFront

 

One of the most important elements of AWS S3 security is maintaining content security through CloudFront application.

CloudFront refers to the environment in which content is served most efficiently through a global network of data centers called edge locations. In other words, you can think of it as a cache server.

CloudFront's security feature is the Origin Access Identity (OAI) feature, which limits direct access to S3 buckets and content. By restricting the direct access of the origin server from the client, you can prevent the exposure of the URL (resource) of your own AWS S3 bucket. In addition, more sophisticated security settings are possible by using CloudFront.

 

 

CloudFront service configuration

 

---

Cloudfront OAI(Origin Access Identity) policy settings

 

---

Cloudfront OAI(Origin Access Identity) policy not settings / Lack of security