AWS Pricing, Limits & other misc Flashcards
S3 Standard Pricing model
GB / month fee for data stored.
$ per GB for data transfer (outbound)
price per 1000 requests.
Used for frequently accessed data.
S3 Upload Object size limit
5 GB per object in a single operation (AWS SDKs, REST API, or AWS CLI).
160 GB per object using the Amazon S3 Console.
Files greater than 5 GB must be uploaded using multi-part uploads.
Max size limit in S3 is 5 TB files per object.
S3 Multi-Part Upload min data size
100 MB file
5 MB min part size
S3 Multi-Part Upload max parts
10K max parts
S3 Multi-Part Upload part limits
min 5 MB
max 5 GB
the last part can be smaller than 5 MB
Max size limit in S3 is 5 TB files per object.
KMS Security standard
FIPS 140-2 (L2)
Federal Information Processing Standard
Some features of KMS are compliant with Level 3, but overall it achieved 140-2 Level 2
CMK
Customer Master Key
• Is logical
○ ID
○ Date
○ Policy
○ Desc & state
CMK data encryption limit
4 KB
DEK
Data Encryption Key
KMS rotation interval for AWS managed CMKs
every 3 years.
enabled by default and cannot be disabled.
KMS rotation interval for CMK
every 1 year after the enable date.
Disabled CMKs are not rotated.
When the CMK is re-enabled, if the key material is more than 365 days old, AWS KMS rotates it immediately.
S3 number of allowed buckets per account
100 buckets soft limit.
can be increased up to 1000 (hard limit) by submitting a service limit increase.
KMS scheduled key deletion waiting period
between 7 and 30 days.
SSE-S3
Server-Side Encryption with Amazon S3-Managed Keys
SSE-KMS
Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS)
SSE-C
Server-Side Encryption with Customer-Provided Keys (SSE-C)
The customer manages the encryption keys.
Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.
Inputs are data and key.
Output are encrypted object and one-way hash of the key.
SSE-S3 x-amz-server-side-encryption header
AWS256
SSE-KMS x-amz-server-side-encryption header
aws:kms
S3 200 Put
data was stored durably.
S3 Standard-IA Pricing model
Retrieval fee for every GB of data retrieved.
GB / month fee for data stored - (less than standard).
$ per GB for data transfer (outbound) - (same as standard)
price per 1000 requests (more than standard).
S3 Standard-IA/One Zone-IA Minimum capacity charge
128 KB per object
S3 Standard-IA use cases
Used for long-lived infrequently accessed data.
Don’t use for small files, frequently accessed, frequently changed or temp data (due to 30 days charge).
Don’t use for data which isn’t inportant or which can be easily replaced (use S3 One Zone-IA)
S3 Standard-IA/One Zone-IA minimum duration charge
30 days
S3 Standard-IA use cases
Used for long-lived infrequently accessed data where resilience is not required. NON-CRITICAL or data which is REPLACEABLE.
Objects have same durability but, cannot be accessed if the AZ fails.
Don’t use for critical data.
Don’t use for small files, frequently accessed, frequently changed or temp data (due to 30 days charge).
S3 One Zone-IA Pricing model
Retrieval fee for every GB of data retrieved.
GB / month fee for data stored - (less than Standard-IA).
$ per GB for data transfer (outbound) - (same as standard)
price per 1000 requests (more than standard).
S3 Glacier Pricing model
Pay for retrieval process:
- Expedited (1-5 minutes) - $10.00 per 1K retrievals
- Standard (3-5 hours) - $0.05 per 1K
- Bulk (5-12 hours) - $0.025 per 1K
Retrieval fee for every GB of data retrieved.
GB / month fee for data stored - (80% less storage costs than Standard).
$ per GB for data transfer (outbound) - (same as standard)
price per 1000 requests.
S3 Glacier first byte latency
Minutes or hours
- Expedited (1-5 minutes)
- Standard (3-5 hours)
- Bulk (5-12 hours)
S3 Glacier minimum duration charge
90 days minimum duration
S3 Glacier minimum capacity charge
40 KB per object
S3 Glacier Deep Archive pricing model
GB / month fee for data stored - (80% less storage costs than Glacier).
Retrieval fee for every GB of data retrieved.
$ per GB for data transfer (outbound).
price per 1000 requests (more than Glacier).
S3 Glacier Deep Archive first byte latency
Hours or days
- Standard (12 hours)
- Bulk (48 hours)
S3 Glacier Deep Archive use cases
Used for archival data which rarely if ever needs to be accessed. Data that needs to be retained due to legal or regulatory requirements.
Hours-days retrieval.
Not suited for system backups.
S3 Glacier use cases
Used for archival data where frequent or realtime acces isn’t needed with Minutes-hours retrieval.
S3 Glacier Deep Archive minimum duration charge
180 day minimum duration
S3 Glacier Deep Archive minimum capacity charge
40 KB per object
S3 Intelligent-Tiering pricing model
Management fee per 1K objects.
No retrieval fees.
Min duration of 30 days.
S3 Intelligent-Tiering use cases
Long lived data (due to 30 days minimum duration).
Usage of objects is changing or unknown. Low admin overhead.
Other prices are comparable to static tiers (Glacier etc).
S3 Glacier Deep Archive minimum duration charge
30 days minimum duration
S3 Intelligent-Tiering migration thresholds
after 30 days - move to Infrequent Access
after 90 days - Archive
after 180 days - Deep Archive
S3 Lifecycle Configuration min duration before transition from S3 Standard is possible
30 days
Objects must be in S3 Standard for 30 days before they can be transitioned automatically.
S3 Lifecycle Configuration min duration before transition to S3 Glacier type in a single rule
30 days
A single rule cannot transition to Standard-IA, Intelligent-tiering or One Zone-IA and THEN to either Glacier type within 30 days.
Have to wait 30 days before the second transition.
This only applies for multi-stage transition performed with a single rule.
S3 Replication default storage class on destination bucket
use the same class as the source for objects. Glacier or Glacier Deep Archive will not be replicated.
S3 Replication ownership account default
default is the source account.
S3 Replication Time Control (RTC) window
replicates 99.99% of objects within 15 minutes
S3 Replication encryption methods
Unencrypted
SSE-S3
SSE-KMS
SSE-C is not supported.
