Amazon S3 Introduction Flashcards
- One of the main building blocks of AWS
- Advertised as “infinitely scaling” storage
What am i?
Amazon S3
Allows people to store objects (files) in “buckets” (directories)
Amazon S3
Buckets must have a what?
Globally unique name
At what level are buckets defined?
Region
The key is the (blank)
Full path
- Preserve, retrieve, and restore every (blank) of every object stored in your buckets.
- You can recover more easily from both unintended user actions and application failures.
Versioning
What does it mean when version ID reads “null”?
It means you uploaded this object before enabling versioning onto the bucket, therefore it will not have version ID
What are 4 methods of encryption objects in S3?
- SSE-S3
- SSE-KMS
- SSE-C
- Client Side Encryption
What does SSE stand for?
Server Side Encryption
Encrypts S3 objects using keys handled & managed by AWS
SSE-S3
Encryption in AWS
Encryption keys managed by AWS
You have full control over the ROTATION policy of encryption key
SSE-KMS
When you want to fully manage your own encryption keys and never store them in AWS
SSE-C
What type of encryption is SSE-S3?
AES-256
User control + audit trail
What method of encryption is this?
SSE-KMS
- Amazon S3 does not store the encryption key you provide
- HTTPS MUST be used
What method of encryption is this?
SSE-C
Customer manages the keys and encryption cycle
Client must decrpyt/encrypt data themselves
What method of encryption is this?
Client Side Encryption
How can an IAM principal access an S3 object?
- the user IAM permissions allows it
- the resource policy ALLOWS it
- AND there’s no explicit DENY
Is there a way to block public access to your S3 bucket?
Yes
URLs that are valid only for a limited time (ex. Premium video service for logged in users)
Pre-Signed URLs
If you get a 403 (Forbidden) error, what should you do?
Make sure the bucket policy allows public reads
What does CORS stand for?
Cross Origin Resource Sharing
If a client does a cross-origin request on our S3 bucket, we need to enable the correct CORS headers. How?
Allow for a specific origin or for *
all origins
Where do the CORS headers need to be defined?
Cross origin bucket
What should you do if website #1 needs to access a resource on website #2 through a web browser?
Give website #2 a CORS setting
if not the web browser is going to block it.
Allows a single object to be uploaded as a collection of parts rather than as one single part.
If one part fails, it can be reuploaded
without affecting any of the other parts.
Multi-part Upload
When is multipart recommended to use?
When file is over 100 MB
(Blank) in any IAM policy will take precedence over an S3 bucket policy
Explicit DENY
Defines a way for client web applications that are loaded in one domain to interact with resources in a different domain
Cross Origin Resource Sharing (CORS)
