I just want to run this idea by some smarter people to make sure I'm not overlooking something obvious:
I want to backup my Linux server to S3 using one of the many backup scripts that allow automatic pruning of backups. So my S3 IAM policy will obviously have to give that user GET, PUT, and DELETE permissions. But since the DELETE permission will be there, I need to plan against the worst-case scenario of a hacker getting root access to my server and deleting the backups on S3 using the stored credentials. To eliminate this possibility, I was thinking about the following configuration:
- Versioning enabled on the bucket (hacker can delete the files but they are only tagged as deleted on S3 and recoverable by me)
- Lifecycle policy enabled on the bucket to automatically delete old versions (eventually eliminating all versions of the file to minimize storage costs)
Then, the only user that would have bucket-deletion or version-deletion permissions would be my main Amazon account user, which I would configure with MFA.
Am I missing anything obvious here?
I did find this claiming that...
You can use the Object Expiration feature on [...] You cannot, however, use it in conjunction with S3 Versioning
...I assume that's obsolete information? In my quick informal experimentation it appears to be possible to use versioning with Object Expiration.
Thanks a lot!