11 nines of durability can't save you from one valid DELETE

transcript

S3 is built to never lose your data. 11 nines. And one stolen key can still delete all of it.

An attacker steals a customer's access keys. They delete every object in the most important bucket. Every request is signed. Every request is valid.

Erasure coding protects against failing drives. Failing servers. Even a whole zone going dark. But here's the catch. A signed DELETE is the system doing what it was told. Durability can't help.

So S3 offers protection. Turn on versioning. Now a plain delete just adds a delete marker. The earlier versions stay recoverable. Remove the marker, and the object's back.

MFA Delete. Erasing versions needs a second factor the stolen keys don't have. Object Lock, compliance mode. Nobody deletes before the retention date. Not even an admin. And keep a copy in another account the keys can't touch.

S3 can't tell stolen keys from real ones. That's why versioning exists. Durability isn't protection.

Full breakdown in the lecture.