Secure access to objects in S3 Archives

The global pandemics have accelerated the rise in telecommuting and remote working has brought about the need to facilitate remote access to objects stored in AWS S3 buckets. Organizations whose end users just require access to Amazon S3 need a client application that provides easy access, as Amazon S3 is not beginner-friendly. While Amazon has an S3 file gateway service/ virtual software appliance that provides an interface for on-premise access to objects in the bucket by caching recent S3 files locally and presenting an SMB or NFS endpoint, one can see how remote access can pose a problem. A clear example is outlined in the use case below.

A private investment firm migrated 2TB data to Amazon S3.
Deployed the file gateway virtual appliance on their on-premise server but used it as an SMB share via an on-premise virtual appliance.
Found it very difficult to connect when working outside the network perimeter, hence deployed a VPN to connect to the office network to mount the drive and access S3 buckets.

The problems encountered:

Multiple objects are created with every change made by an SMB client through the file gateway, and the need for lifecycle policies to be set up to curtail it and can quickly complicate things.
It’s inconvenient to connect to a VPN to mount a drive to an internal IP address before using Amazon S3 as an SMB share.

In this article, we’ll show you how to work around Amazon’s S3 file gateway’s LAN access constraints for simplicity and convenience in a remote working environment.

Why S3 Object Storage?

Amazon S3 is a highly durable, cost-effective, and scalable cloud infrastructure service for enterprises. When used as an on-premise server backup, it offers flexible storage management capabilities, even much better than other cloud computing service providers.

Scaling business infrastructure to the cloud is a digital transformation trend businesses are adopting to meet growing business needs and survive in the rapidly evolving digital world. While cost is an inhibiting factor for cloud migration, Amazon S3 offers the best cost-saving incentives, especially for businesses with big data. With S3 bucket unlimited storage capacity, companies do not have to worry about incurring heavy expenses from storing their data in the cloud or managing data centers to keep up with their growing storage needs.

The primary concern about mirroring in-office user experience to ensure seamless collaboration while maintaining security and controlling data resources to stay policy-compliant is quite challenging.

As previously stated, the S3 file gateway enables on-premise applications with low-latency access to data stored in the bucket, which means provisions should be made for users accessing those objects outside the network perimeter. While there are a number of S3 access tools available, such as CloudberryLab S3 Explorer, TntDrive, or ElephantDrive, few provide a ‘file server’ experience to simplify the process, much like Dropbox provided a user-friendly interface to store files, relying solely on the S3 bucket storage architect of the AWS.

1. High Complexity

S3 is a massive storage bucket, so IAM policies need to be updated to provide folder-level permissions for those with access to particular S3 buckets to ensure granular control over data. However, Amazon’s IAM policies can get complex, especially when many users require varying levels of access permissions to multiple buckets.

2. Data Compliance

There is no central console to monitor or account for who has access to what data or to track users’ activity. Because S3 does not have a bucket filter option, any user identity generated in the IAM can display all buckets in the linked AWS account, which could result in a compliance breach.

Triofox is a cloud file server solution that addresses these problems. Equipped with remote and mobile access features, the Triofox client agent can be used as a gateway stand-in when coupled with an identity provider (IDP) for authentication to access files stored in the S3 bucket.

How Triofox Addresses the Challenges?

1. Eliminate VPN Hassles

Triofox’s mapped drive eliminates excessive workarounds to access files (stored as objects), saving users time and enabling IT personnel to focus on more critical tasks.

2. Provides Security Without Compromising Productivity

Triofox supports native integration with Active Directory to protect sensitive files from unauthorized access while providing a seamless remote working experience for authenticated users across devices, improving productivity. End-users also have restricted access to their files and file shares, which are provided automatically when the existing identity management system is integrated.

3. Cache files for low Latency Access and WAN Optimization

Like the S3 file gateway, Triofox provides local caching to enable users offline access to recent files. A helpful feature for users working from home with lower bandwidth. In this case, an encrypted, remote agent cache is set up on each client, and only changes are synchronized to the file storage when connectivity is restored. It is also helpful for employees who need access to data but might not be in a location with an active internet connection.

In addition, access can be immediately cut off from the central console when an endpoint is compromised.

4. Maintain Data Governance and Compliance Guidelines

IT has full control over what happens to data thanks to a centralized user management panel. Every activity performed on data is logged and traceable to the user thanks to its audit trace and files log feature.

Triofox Implementation

Here’s how Triofox can be used to enhance S3 bucket access:

Deploy Azure Active Directory as the identity provider (sync on-premise AD with Azure Active Directory).
Configure and Install the Triofox server on a clean Windows Server virtual machine and integrate Active Directory, selecting S3 as the file storage (see link for complete steps).

The result is end-users can enjoy the ease of a cloud server interface. This is an excellent solution for organizations that prioritize security and productivity.