S3 Flashcards
A _______ is a container for objects.
bucket
An _______ is a file and any metadata that describes that file
object
Every object in Amazon S3 is stored in a _____
bucket
Bucket name must be unique just within your account. T/F
False. Bucket name must be uniqueglobally/ within a partition - us, china, etc.,
Character length of bucket.
3-63 characters.
bucket name characters conditions.
Only lowercase, numbers, dots and hyphens; no upper case.
Bucket name must begin with ?
lower case alphabet or a number
Bucket name must end with ?
lower case alphabet or a number
Use IP address format for Website buckets. T/F
No. Bucket names must not be of IP address format
Buckets used with ____________ can’t have dots in their names.
S3 Transfer Acceleration.
Best practice is to avoid using dots except for
Buckets used only for static web hosting.
In terms of implementation, buckets and objects are ___________ and we have unique ids called _________
AWS resources and ARN (Amazon Resource Names)
The AWS account that creates a resource owns that resource. T/F
True
If you create an IAM user in your AWS account and grant the user permission to create a bucket, the user can create a bucket. Now, who owns the bucket?
The user does not own the bucket; the AWS account that the user belongs to owns the bucket
If you create an IAM user in your AWS account and grant the user permission to create a bucket, the user can create a bucket. Can the user perform other activities on the bucket?
No. The user needs additional permission from the resource owner to perform any other bucket operations.
Public access is granted to buckets and objects through ____________ and ___________ or both.
access control lists (ACLs), and bucket policies,
_____________ settings can override ACLs and bucket policies
Amazon S3 Block Public Access
You can apply Block Public Access settings to _________buckets in your account.
individual or all buckets
You can configure object-level permissions by configuring _________ specific to that object.
An access control list (ACL)
cors
cross-origin resource sharing
What does cors enable?
You can configure your bucket to allow cross-origin requests.
s3 lifecycle
You can define lifecycle rules for objects in your bucket that have a well-defined lifecycle.
Server access logging S3
Server access logging provides detailed records for the requests that are made to a bucket
What is the default server access logs collection status?
By default, S3 doesn’t collect server access logs.
Where does S3 delivers the server access logs for a target bucket ?
Into another bucket
Can target and source bucket reside in different regions and what must be the default retention period of a source bucket ?
The target and source bucket must reside in the same region. The source bucket must not have any default retention period.
What is retention period?
A retention period specifies a fixed period of time during which an object remains locked.
What happens when a object is locked?
When your object is locked, your object is WORM protected and can’t be over-written or deleted.
What is WORM in object locking?
Write Once Read Many
How many days can you apply for object locking?
You can apply for object locking in days or years with minimum value of 1 day to no max limit.
Example situation of using object locking.
To keep the golden copy of the business records.
Charge for using object locking.
No charge for using object locking.
What are WORM Storage capabilities?
S3 Glacier Vault Lock and S3 Object lock
What is the unique feature of S3 Object lock?
Amazon S3 Object lock is the only cloud object storage WORM capability in the market today that gives you the flexibility to apply retention settings on individual objects in addition to default retention settings for all objects within an S3 bucket
Amazon S3 object lock provides object retention by
- Retention period
2. A legal hold
What is a legal hold ?
A legal hold provides the same protection as retention period, but it has no expiration date. A legal hold remains in place until you explicitly remove it.
Can a object version have a combination of both retention period and legal hold?
Yes. Ex: 1-Year retention period and legal hold.
What retention modes are available with Amazon S3 lock?
- Governance
2. Compliance
What does Governance mode entail?
Governance mode protects objects from being deleted by most of the users during a pre-defined retention period and at the same time some users with special permission will be able to alter the retention settings or delete the objects.
Users with _______ permission can override or remove governance-mode retention settings
s3:BypassGovernanceRetention
Most customers use Governance mode over Compliance mode since
the customers don’t have compliant storage requirements.
What does compliant mode entail ?
With compliance mode, no user, including the root user in AWS account will be able to delete the objects during the pre-defined retention period.
What is the only way to delete the object under Compliance mode within the retention period?
To delete the AWS account it is associated to
When to actually use legal hold
Use legal hold when you aren’t sure how long you would like the objects to stay immutable.
Use compliance mode if you have______ data
compliant.
What is the retention period of legal hold.
The retention period of legal hold is infinite. Only users with special permissions are able to lift the hold.
How does S3 object lock apply for Cross-region replication?
In addition to locking objects, you can configure your S3 buckets to enable automatic, asynchronous copying of locked data and associated metadata to a bucket in a different aws region.
S3 objects can only be locked if the respective bucket is configured to use object lock.
Yes.
Amazon S3 Object lock only works for buckets that have _________ enabled.
Versioning.
Can you turn on AWS S3 Object support for old buckets? If yes, how do you do that?
You can only enable S3 Object lock only to new bucket. To enable object locking for old buckets, contact AWS Support.
Can anyone put objects with object lock into a bucket which is configured with object lock?
No. Only users with special permissions can add immutable objects to the respective bucket.
When a bucket is configured with Object lock and retention mode, does it apply to all the objects that are placed in the bucket ?
Yes.
Can I change retention mode and period for a specific object ?
Yes.
Object Lock settings can’t be specified on _____ using the S3 console
upload
When you create a bucket with Object Lock enabled, Amazon S3 automatically enables ______ for the bucket.
versioning
If you create a bucket with Object Lock enabled, you can’t _____________
disable Object Lock or suspend versioning for the bucket.
If you want to automatically protect object versions that are placed in the bucket, you can configure a ______.
default retention period
If you want to enforce the bucket default retention mode and period for all new object versions placed in a bucket, then ________
set the bucket defaults and deny users permission to configure object retention settings.
Bucket default settings require both a ________ and _______
mode and a period
After the object is created, its retention period is ________ from the bucket’s default retention period.
independent
f you configure a default retention period on a bucket, requests to upload objects in such a bucket must include the ___________
Content-MD5 header.
By enabling server access logging, S3 console will automatically update your _________ to include access to the ________
bucket access control list (ACL), S3 log delivery group.
Server access logs don’t record information about ____________
wrong-region redirect errors for Regions that launched after March 20, 2019.
How are S3 logs delivered?
Amazon S3 periodically collects access records, consolidates the records in log files, and then uploads the log files to your target bucket as log objects.
Which account does S3 use to write access logs?
Log Delivery Group
Server access log records are delivered on a _________
best effort basis
Most log records are delivered within _______
a few hours of the time that they are recorded, but they can be delivered more frequently.
The completeness and timeliness of server logging is guaranteed. T/F
False. Possibility of missing logs, rare but possible.
If you change the target bucket for logging from bucket A to bucket B, logs for the next hour might continue to be delivered to
Some logs for the next hour might continue to be delivered to bucket A, while others might be delivered to the new target bucket B.
What is Canonical userid
An alpha-numeric identifier, such as 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be
When is canonical userid used?
You can use this ID to identify an AWS account when granting cross-account access to buckets and objects using Amazon S3.
Amazon S3 event notifications are designed to be delivered _________
at least once.
What events can AWS publish notifications for S3
- New object created events
- Object removal events
- Restore object events
- Reduced Redundancy Storage (RRS) objects lost events
- Replication events.
Amazon S3 sends event notifications for replication configurations that have _________ enabled.
S3 replication metrics or S3 Replication Time Control (S3 RTC)
Amazon S3 supports __________ destinations where it can publish events
- Amazon Simple Notification Service (Amazon SNS)
- Amazon Simple Queue Service (Amazon SQS) queue
- AWS Lambda
What is Amazon Simple Notification Service (Amazon SNS)
Amazon SNS is a flexible, fully managed push messaging service using which, you can push messages to mobile devices or distributed services.
Main feature of SNS
With SNS you can publish a message once, and deliver it one or more times. Pub-Sub
What version of SNS is currently allowed and not allowed in S3
Currently Standard SNS is only allowed as an S3 event notification destination, whereas SNS FIFO is not allowed.
What is Amazon Simple Queue Service (Amazon SQS) queue ?
Amazon SQS offers reliable and scalable hosted queues for storing messages as they travel between computers. You can use SQS to transmit any volume of data without requiring other services to be always available.
What version of SQS is currently allowed and not allowed in S3
Currently, Standard SQS queue is only allowed as an Amazon S3 event notification destination, whereas FIFO SQS queue is not allowed.
What causes an execution loop?
If your notification writes to the same bucket that triggers the notification, it could cause an execution loop.
To send S3 notifications to SNS, you must configure a _______ on SNS’s end where you can write to notifications to.
Topic
In which region must be the SNS topic to which the S3 notifications are sent to.
The SNS topic must be in the same region as the S3 bucket, which notifications it delivers.
Before you use the AWS SNS topic as event notification destination, what information do we need ?
- ARN of SNS topic
2. A valid SNS topic subscription.( The topic subscribers are notified when a message is published to your SNS topic.)
In which region must be the SQS queue to which the S3 notifications are sent to.
The Amazon SQS queue must be in the same Region as your Amazon S3 bucket.
Before we can use the SQS queue as the event notification destination, what information do we need ?
ARN of the SQS Queue
To grant Amazon S3 permissions to publish messages to the SNS topic or SQS queue, you attach an __________ to the destination SNS topic or SQS queue.
AWS Identity and Access Management (IAM) policy
Enabling notifications is a ______ level operation.
bucket
You store notification configuration information in the _______ associated with a bucket.
notification subresource