S3

Overview

You need to know this service inside and out to pass the exam.

What is S3? It is a storage service that provides a way to store data in the cloud.

Object-based storage

Buckets are a universal namespace. All AWS accounts share the namespace. It must be globally unique.

The S3 URL looks like https://<bucket-name>.s3.<region>.amazonaws.com/<key-name>.

When you upload a file, a successful upload will get a 200 response.

Key-Value Store

Highly Available and Highly Durable

Standard S3

Characteristics

Securing Your Data

Data consistency

Strong Read-After-Write Consistency.

What to know

Files are stored in buckets and S3 is a universal namespace. Know the URL build out and 200 response on success.

Four more tips:

Securing Your Bucket with S3 Block Public Access

By default, all public access is blocked.

If a bucket is not public, you cannot override the access level of an individual object.

Review on tips:

Hosting a Static Website Using S3

Can host static websites (such as .html websites). Cannot do Dynamic websites.

The policy required for hosting a static website:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3::BUCKET_NAME/*"]
    }
  ]
}
copy

The resources given are a basic index.html page and an error.html page.

When creating a new bucket via the console, you specify that you want to host a static website and you set the object entry point and error page.

You could make the files individually public, but that is time consuming. Instead, we edit the bucket policy to allow access.

To recap:

Versioning Objects in S3

You can enable versioning in S3 to allow multiple versions of objects within a bucket.

Inside of a bucket, you go to Properties and you can edit to enable bucket versioning.

Once on, there will be a toggle to List Versions that can show which version of the object is there. The demo itself uploads to new file.

Previous versions do not allow access (even if the policy is for a public policy). You can turn the ACL for that object to be public.

For deleted objects, the versions will still be there (but with a delete marker). Once you delete the delete marker, it actually reverts to the previous version.

S3 Storage Classes

For standard:

For Standard-IA (infrequent access):

For S3 One Zone Infrequent Access (1ZIA):

Glacier

Glacier (cold storage) is the last type and has two options.

S3 Intelligent-Tiering

Be sure to know the different use-cases in S3 storage tiers.

Lifecycle Management with S3

Automates the moving of objects between different storage tiers.

E.g. you may set S3 Standard object unused for 30 days to S3 IA and 90 days to Glacier.

You can integrate this with versioning too!

In the bucket under Management, you can create your Lifecycle rule.

With versioning turned on, you can also change the rule actions for things such as "transition".

With each action, you can specify which object is transitioned after X amount of days to what class.

Once created, you can also see a Timeline summary.

The tips:

S3 Object Lock And Glacier Vault Lock

You can use S3 Object Lock to store objects using a write once, read many (WORM) model. It can help prevent objecst from being deleted or modified for a fixed amount of time or indefinitely.

You can use it to meet regulatory requirements that require WORM storage, or to add an extra layer of protection again object changes and deletion.

Governance mode

Users can't overwrite or delete an object version or alter its lock settings unless they have special permissions.

Compliance mode

No one can overwrite or delete an object version or alter its lock settings.

Retention Periods

Protects an object version for a fixed amount of time.

After the period expires, the object version can be overwritten or deleted unless you also placed a legal hold on the object version.

Legal Holds

S3 Object Lock enables you to place a legal hold on an object version. Like a retention period, it prevents overwrite/deltion, however it doesn't have an associated retention period and remains in effect until removed.

Those with the s3:PutObjectLegalHold permission can add/remove.

Glacier Vault Lock

Allows you to easily deploy and enforce compliance controls for individual Glacier Vaults with a Vault lock policy.

You can specify controls (such as WORM) in a Vault lock policy and lock policy from future edits. Once locked, the policy can no longer be changed.

S3 Object Lock Exam Tips

Encypting S3 Objects

The types of encryption:

You can enforce server-side encryption:

If the file is to be encrypted at upload time, the x-amz-server-side-encryption parameter will need to be included in the request header.

There are two options: AES256 or aws:kms.

It is put into the header to tell S3 to encrypt objects during the upload.

To enforce this, you can set a bucket policy to deny any object PUT request that does not include the encryption header.

In the console, there is a Default Encryption option when creating a bucket.

Optimizing S3 Performance

The S3 prefix for mybucketname/folder1/subfolder1/myfile.jpg is folder1/subfolder1.

The limitations with KMS:

Multipart Uploads

S3 Byte-Range Fetches

Back up Data With S3 Replication

Used to be called cross-region replication, but now can happen in the same region.

To demo: you can create replication rules under Management. You will need versioning on first. You can select the destination bucket from there.

The tips: