NextLabs adds fine-grained S3 security with ABAC and masking

NextLabs on July 14, 2026, launched Data-Centric Security for AWS S3, a policy layer that adds centralized attribute-based access control and dynamic data masking to Amazon S3. The move is aimed at tightening access to enterprise data in S3 without changing application code.

Why it matters: - Amazon S3 has become core infrastructure for enterprise data, analytics, AI services, and data lakes. - NextLabs is targeting a gap in cloud security: the need to control not just who can reach S3, but what they can see, query, update, and delete under specific conditions. - The approach is designed to support least-privilege access and Zero Trust data security across users, applications, partners, suppliers, contractors, and cloud-native tools.

What happened: - NextLabs announced the availability of NextLabs Data-Centric Security for AWS S3 on July 14, 2026. - The product secures both application and user access to Amazon S3 using centralized Attribute-Based Access Control policies. - The launch extends NextLabs’ Zero Trust and dynamic authorization platform into AWS S3. - NextLabs said the platform evaluates each access request in real time without requiring application code changes.

The details: - The policy engine uses attributes tied to the application, user, environment, requested resource, and business context. - Enforcement can occur at the tenant, bucket, directory, query, or object level across S3 bucket types. - The product includes bucket-, folder-, and object-level filtering so users and applications only see authorized data. - Table Bucket security adds row-level and column-level authorization for analytics workloads. - Dynamic field-level masking protects sensitive data in real time using centrally managed masking policies. - Record-level segregation and filtering can be based on user, application, data, and business attributes. - The solution also authorizes S3 operations such as create, insert, update, and delete. - Centralized policy management is intended to keep authorization consistent across applications. - Monitoring and auditing capture application and user activity for compliance reporting, security analytics, and operational visibility. - The product supports applications using Amazon S3 out of the box, without custom application development.

Between the lines: - The launch reflects a broader shift from perimeter security to data-centric controls that travel with the data itself. - By externalizing authorization from applications, NextLabs is trying to reduce the operational cost of policy changes and avoid app rewrites. - The feature set suggests NextLabs is also pitching the product to teams running sensitive analytics on S3 Table Buckets, where row and column controls matter most.

What's next: - Organizations adopting the product can update authorization policies centrally and apply changes immediately without application downtime. - NextLabs says the system is built to help companies improve regulatory compliance and accelerate cloud adoption while keeping sensitive data protected.

The bottom line: - NextLabs is betting that fine-grained ABAC and dynamic masking will become table stakes for securing enterprise data in Amazon S3.