AWS Certified Security – SpecialtyDomain 1: Incident ResponseMedium
A media company experiences a defacement of their public-facing website hosted on Amazon S3. The security team suspects an unauthorized modification of the S3 bucket's content. They need to quickly revert the website to a known good state. Assuming S3 Versioning was enabled on the bucket prior to the incident, which action should the security team take to recover the website with minimal downtime?
- ADelete the current defaced objects and upload a new, clean version of the website content.
- BIdentify the object versions prior to the defacement and promote them to the current version.
- CChange the S3 bucket policy to deny public write access and then re-upload the original content.
- DRestore the entire S3 bucket from a previous day's AWS Backup recovery point.
Show answer & explanationAnswer & explanation
Correct answer: B. Identify the object versions prior to the defacement and promote them to the current version.
With S3 Versioning enabled, every modification creates a new version of an object. The quickest way to revert a defacement is to identify the last known good version of the affected objects and make them the current version, effectively rolling back the changes.
Why the other options are wrong
- A. This approach is manual, time-consuming, and prone to errors. It also doesn't leverage the existing versioning capability for a quick rollback.
- C. Changing the bucket policy is a good preventative measure but does not recover the defaced content. Re-uploading is manual and less efficient than using versioning.
- D. Restoring an entire bucket from AWS Backup is a valid recovery strategy but is typically slower and might overwrite legitimate recent changes not related to the defacement. Versioning is faster for specific object rollbacks.
S3 Versioning for Recovery
S3 Versioning keeps multiple versions of an object in the same bucket, allowing for recovery from unintended deletions or modifications by retrieving a previous version.
- Protects against accidental overwrites and deletions.
- Enables quick rollback to a previous state.
- Each write operation creates a new object version.
Memory trick: Versioning is your time machine for S3 objects.