You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 16362e3
Browse filesBrowse the repository at this point in the historyBrowse files
Copy file name to clipboardExpand all lines: SECURITY.md
+63Lines changed: 63 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,6 +9,69 @@ Versions are currently being supported with security updates.
9
9
| 2.x.x |:white_check_mark:|
10
10
| 1.x.x |:x:|
11
11
12
+
## TLS/SSL Configuration
13
+
14
+
By default, s3cli validates TLS certificates. To skip TLS verification (not recommended for production), use the `--insecure` or `-k` flag:
15
+
16
+
```bash
17
+
s3cli -e https://s3.example.com -k ls
18
+
```
19
+
20
+
**WARNING**: Disabling TLS verification makes connections vulnerable to man-in-the-middle attacks. Only use this flag in trusted development environments or with explicit understanding of the security implications.
21
+
22
+
## Authentication
23
+
24
+
### AWS Signature Versions
25
+
26
+
s3cli supports both AWS Signature Version 4 (default) and Version 2:
27
+
28
+
-**Version 4** (default): Uses SHA-256 for HMAC, recommended for all new applications
29
+
-**Version 2** (`--v2sign`): Uses SHA-1 for HMAC as required by the protocol specification
30
+
31
+
Note: AWS Signature V2 requires SHA-1 as part of the protocol specification. For security reasons, prefer Signature V4 which uses SHA-256.
32
+
33
+
### Credentials
34
+
35
+
Credentials can be provided via:
36
+
1. Command-line flags: `--ak` (access key) and `--sk` (secret key)
37
+
2. Environment variables: `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`
38
+
3. AWS credentials file with `--profile`
39
+
40
+
**Important**: Never commit credentials to version control. Use environment variables or secure credential management systems.
41
+
42
+
## Security Considerations
43
+
44
+
### Endpoint Security
45
+
46
+
-**HTTP vs HTTPS**: If no protocol is specified, s3cli defaults to HTTP. Always specify `https://` for secure connections.
47
+
-**Custom endpoints**: When using self-signed certificates, use `--insecure` flag sparingly and understand the risks.
48
+
49
+
### Presigned URLs
50
+
51
+
Presigned URLs generated by s3cli (`--presign` flag) provide temporary access to S3 resources:
52
+
- Default expiration: 24 hours
53
+
- Customize with `--presign-exp` flag
54
+
55
+
Treat presigned URLs as sensitive credentials - anyone with the URL can access the resource until expiration.
56
+
57
+
### Object Lock and Versioning
58
+
59
+
For compliance and data protection, consider enabling:
60
+
-**Object Lock**: WORM (Write Once Read Many) retention
61
+
-**Versioning**: Protect against accidental deletion
62
+
63
+
## Dependency Security
64
+
65
+
This project uses:
66
+
-`github.com/aws/aws-sdk-go` - Official AWS SDK for Go
67
+
-`github.com/spf13/cobra` - CLI framework
68
+
-`github.com/johannesboyne/gofakes3` - S3 mock server (testing only)
0 commit comments