FAQ-000345 - Cloud Storage Security / S3 Access Control and Authorization

To secure and address unauthorized access to S3 objects: **Access Control Implementation:** - Implement proper access controls and security measures to restrict unauthorized access - Regularly review and update permissions to ensure they align with the principle of least privilege - Ensure that access controls are properly configured to restrict unauthorized access **Secure Data Storage:** - Securely store sensitive data, such as access keys or tokens, preferably in protected custom settings, custom metadata, or Named Credentials - Use Named Credentials for external service authentication to avoid hardcoded credentials in your code - Provide evidence that the information stored in the S3 bucket is compiled from publicly available resources, if applicable **Temporary Access Management:** - Use pre-signed URLs for temporary access to S3 objects, ensuring they're time-limited and scoped to specific actions - Validate and sanitize any parameters used in generating these URLs to prevent misuse - Use HTTPS endpoints when communicating with S3 services **Documentation and Compliance:** - If there are findings related to S3 bucket vulnerabilities during AppExchange Security Review, document the use case clearly and provide supporting evidence in the false positives documentation - Category: Cloud Storage Security - Subcategory: S3 Access Control and Authorization

The FAQ content is generally accurate and comprehensive. I made minor improvements to enhance clarity and alignment with Salesforce security best practices: 1. **Improved credential storage guidance**: Added 'custom metadata' and 'Named Credentials' to the storage options and included a specific bullet about using Named Credentials for external service authentication. This provides more complete guidance on secure credential management options. 2. **Enhanced security terminology**: Changed 'they are' to 'they're' for more conversational tone per the brand guidelines, and clarified 'HTTPS endpoints' for more specific security guidance. 3. **Maintained all original content**: All existing security points and structure were preserved while improving clarity. **Security Rules Analysis:** - **ApexSuggestUsingNamedCred**: Directly relates to the FAQ's guidance on "securely store sensitive data, such as access keys or tokens" and the recommendation to use Named Credentials for external service authentication to S3. - **AvoidHardcodedCredentialsInFieldDecls**: Relates to the FAQ's emphasis on secure storage of "access keys or tokens" rather than hardcoding them in field declarations. - **AvoidHardcodedCredentialsInVarAssign**: Connects to the FAQ's guidance about securely storing credentials instead of hardcoding them in variable assignments when working with S3. - **AvoidHardcodedCredentialsInVarDecls**: Applies to the FAQ's recommendation to use "protected custom settings or metadata" rather than hardcoded credentials in variable declarations. - **AvoidHardcodedCredentialsInHttpHeader**: Relevant to the FAQ's discussion of securing S3 access, as developers might hardcode AWS credentials in HTTP headers when making S3 API calls. - **ApexInsecureEndpoint**: Connects to the FAQ's recommendation to use HTTPS endpoints when communicating with S3 services, ensuring secure connections.