How is the object storage protected against unauthorized access?
Yes. All S3 buckets at amaise are comprehensively secured — both at the infrastructure and application levels:
Infrastructure level (KMS-based):
Encryption: Customer data is encrypted with tenant-specific KMS keys (SSE-KMS). Each tenant receives its own Customer Managed Key (CMK). Infrastructure data uses SSE-S3.
No public access: Public read and write access is forbidden on all buckets, enforced by NIST config rules.
SSL-only: Bucket policies enforce encrypted connections only (HTTPS).
Access control: No direct public S3 access is possible — access is exclusively via CloudFront (HTTPS) and VPC gateway endpoints.
Application level (workspace/tenant isolation):
Tenant separation: At the application level, access is strictly isolated by workspace or tenant. Every access is validated against the authenticated tenant ID.
Key assignment: The tenant-specific CMK is assigned at the earliest system entry point (Entry Proxy) and used for all subsequent operations.
Monitoring and audit:
S3 access logs are sent to a central logging bucket and retained for 90 days. CloudTrail records all S3 data events.
Bucket configurations are reviewed as part of quarterly security audits and continuous IaC security scans.