S3 1 Flashcards
Versioning
How do you disable versioning?
Can’t, but can pause it.
Versioning
What is the version Key ID on an object without bucket versioning?
Null
Versioning
When is a Key ID null once a bucket is versioned?
Absolutely never.
Versioning
What happens when you delete an object on a versioned bucket?
Adds a delete marker.
Versioning
What happens when you delete a Key ID on a versioned bucket?
True delete, gone forever.
Signed URLs
How long is a signed URL good for?
Until the creds that signed it expire or it’s expiration.
Signed URLs
What can you do with a signed URL?
Whatever the Principal that signed it can do. Careful signing with R/W privs if you only want to grant R/O!
Signed URLs
Can you scope down a PSU to just s3:GetObject, for example?
No. Uses full access rights of whatever signed it.
Signed URLs
What is the problematic constraint with signed URLs?
Signed URL expires when the temp creds expire that signed it.
Signed URLs
Best practice for signing PSUs?
Use IAM User creds (long-lived creds)
Signed URLs
App has a PSU. What boto3 S3 call needed to use it?
Nope, it’s a URL, so use requests: straight HTTPS client only.
Signed URLs
Can you create a PSU for an object you don’t have access to?
Yes
Signed URLs
Generate PSU, change permissions on signing role, then use PSU. What happens?
Uses the at-this-moment permissions of the signing role when PSU used
Signed URLs
Use a PSU, what’s in the audit/access log?
Looks like the principal that signed the PSU did the access
