S3 Batch Copy : Data Security over Transit

Question

Hello,

**Use Case:**
*S3 Transfer data Cross Account:* I want to transfer data across two buckets cross two accounts that are not owned by the same organization.

**Implementation**
1. As the data is going be residing in the same region, we are going to be using S3 Batch COPY. 
2. Why S3 Batch? because the destination user wants to be able to pull data whenever required due to certain restrictions. As S3 Replication will keep copying data as soon as it is uploaded to the S3 Bucket.
2. Using Manifest.csv file located in the Source account. The source user will be updating the manifest.csv when new data is ready to be transferred across accounts.
3. We have also limited the source bucket to Deny any requests that aren't over HTTPS (this was done by adding a deny statement with the condition  "aws:SecureTransport": "false")
3. This solution is working and we are able to transfer data successfully across the buckets located in separate accounts.

**Queries:**
I have tried finding the answers for my questions below to no avail, its not mentioned in any document that I have gone through. Any help would be greatly appreciated.
1. When using S3 Batch, is the data in transit secure? What I mean by this is that 
* Is it over Secure Line (like AWS's own backend private network?)
* Is the data encrypted over transit?
* Can S3 Batch COPY work Cross Regions Cross Account?

2. Also the same question w.r.t S3 Replication, is the data in transit secure? What I mean by this is that 
* Is it over Secure Line (like AWS's own backend private network?)
* Is the data encrypted over transit?

Below is a simple diagram of what I have setup currently,

![Enter image description here](/media/postImages/original/IMTS_PPp58Ssa6_6D2rjjndg)

Thank you!!

Accepted Answer

I had a chance to connect with a AWS Tech, so the below were my questions and his answers,

1. When using S3 Batch, is the data in transit secure? 
Ans: We(AWS) use the AWS private network for object copying between S3 buckets within the same region. Also, for object copying between S3 buckets between different regions excluding the China region, we use the AWS private network, so you can think of it as not going through the basic public internet.
2. Is data in transit Secure? 
Ans: When using batch operations, the S3 API is used for copying between S3 buckets, but if TLS encryption is required when communicating with the API, we recommend using the aws:SecureTransport condition key in the bucket policy to force HTTPS access.

Answer

Hey @rePost-User-1408429

Let me break this answer down in pieces. 
>    When using S3 Batch, is the data in transit secure? What I mean by this is that
>
>   Is it over Secure Line (like AWS's own backend private network?)
>  Is the data encrypted over transit?
> Can S3 Batch COPY work Cross Regions Cross Account?

Within [this link](https://aws.amazon.com/s3/features/batch-operations/) Capital One and ePlus talk about using batch across regions.

S3 Batch is fundamentally powered by S3 replication.

Access to s3 can be provided via Privatelink Gateway or Interface. See [Access AWS Batch using an interface endpoint](https://docs.aws.amazon.com/batch/latest/userguide/vpc-interface-endpoints.html) for how to perform such over interface endpoint.

I also looked to see if Batch supports in transit, my suggestion would be to first:
a. apply concept from "Access AWS Batch using an interface endpoint" 
b. test if encryption in transit can be honored by applying items as discussed in this other re:Post link [here](https://repost.aws/knowledge-center/s3-bucket-policy-for-config-rule)

Please do give this a accepted answer if you feel thusly. Best of luck and please do let us know if this worked out!

S3 Batch Copy : Data Security over Transit

Relevant content