Access Points and Object Lambda

Access policy for access points

The access policy of an endpoint works in conjunction with the access policy of the bucket. For example, if the access point’s policy allows a user to write to a bucket, the bucket policy should allow it as well. Otherwise the user might not be able to write objects to the bucket. However, managing access at multiple places can be difficult, especially with multiple users and access points. To simplify it, we can configure a bucket policy to delegate access to Access Points. This would grant access to the user based on the access policy of the Access Point only. It is ideal for use cases where we do not allow direct access to the bucket.

In addition, each Access Point has its own Block Public Access setting. Thus, when a request arrives at the endpoint, S3 allows access only after checking the Block Public Access setting of the access point, underlying bucket, and bucket owner.

Network access control

To control the bucket’s network access, we can restrict the access point to a single VPC. An Access Point that accepts requests from anywhere on the internet is said to have a network origin of Internet. Similarly, the access point that allows requests from a specific VPC is said to have a network origin of a VPC. To allow requests from a specific VPC, we specify the VPC ID while configuring the access point. This setting can not be modified once the access point is created.

Multi-Region Access Points

Amazon S3 allows us to create global access points available in multiple regions. These access points route the requests through the AWS global network to the closest S3. While creating a Multi-Region Access Point, we can define the regions where we want the data to be served. To replicate and synchronize data between these regions, we can use Cross Region Replication (CRR) in S3 buckets.

Object Lambda Access Points

Object Lambda Access Points is a feature that allows to modify or generate custom responses as objects are retrieved from S3. It enables us to process data stored in S3 on-the-fly using AWS Lambda functions, allowing for dynamic transformations, encryption, or other custom logic without modifying the original object stored in S3. For example, we can filter the images returned by S3 GET request based on the image extension.

It only supports the GET, LIST, and HEAD requests. When a request is made to the access point, it invokes a Lambda function, pulls data from S3, processes the data, and streams back the response. The processing of data happens in line with the request. To create an Object Lambda, we need an S3 access point, a Lambda Function, and the custom code.

Use case: Remove sensitive information

S3 Object Lambda Access Points are used for various purposes, such as masking sensitive data for security and compliance, compressing objects, changing data formats for compatibility, and filtering data to deliver specific information.

Consider one such application where a healthcare organization stores patient records in S3 buckets. These records contain sensitive information such as medical history, treatment plans, and test results. To comply with regulations, the organization must ensure that only authorized personnel can access patient data and that sensitive information is protected from unauthorized disclosure.

The application consists of two main dashboards to list user information: the administrator and the health care provider. Both dashboards fetch information from the same data store; however, the healthcare provider shall receive a masked version of the object, removing the sensitive information. Meanwhile, the administrator requires the entire object.

In this scenario, the organization can use the Lambda function to dynamically redact sensitive information from patient records before authorized users retrieve them. For example, when a healthcare provider requests a patient’s medical record from the S3 bucket, the Object Lambda Access Point intercepts the request and applies redaction logic to mask or remove sensitive details such as the patient’s name, address, and social security number. The redacted record is then returned to the requester, ensuring that only necessary information is disclosed and patient privacy is maintained.