S3 Flashcards
What is an object in S3?
It is a file
What is a bucket in S3?
It is a directory
What are 2 things to remember when creating a new bucket?
- You must choose a globally unique name
- Buckets are defined at the region level
What are 4 restrictions when choosing a bucket name?
- No uppercase
- No underscore
- 3-63 chars long
- Not an IP
Are the really directories in S3?
No, the UI looks like it but there are only buckets and objects?
How do we access Objects?
We use the Key
What is the Object Key?
It is the full path after the bucket name
Example: s3://mybucket/
What is the max size of an object?
The max size is 5TB
What is the largest size that can be uploaded at once?
5GB
How do I upload a 5TB object if the max to upload in one time is 5GB?
Use Multi-part upload
Can I version my files in S3?
Yes
How do I enable versioning?
Versioning is enabled at the bucket level
Using versioning, what if I upload a new file using the same key?
It will not overwrite, it will create a new version of the file
What are the 4 methods of encryption for S3?
- SSE-S3: encrypts objects using keys managed by AWS
- SSE-KMS: uses AWS Key Management Service to manage encryption keys
- SSE-C: manage your own encryption keys
- Client Side encryption
How does SSE-S3 work?
Uses AWS keys to encrypt objects server side and uses the AES-256 encryption type
What header must you set for SSE-S3?
“x-amz-server-side-encryption”: “AE256”
How does SSE-KMS work?
Uses AWS Key Management Service keys to encrypt objects server side
What are 2 advantages of using SSE-KMS?
- User control
- Audit Trail
What header must you set for SSE-KMS?
“x-amz-server-side-encryption”: “aws:kms”
How does SSE-C work?
Uses encryption keys fully managed by the user to encrypt server side
Does S3 store my encryption key when using SSE-C?
No. The encryption key must be provided in the headers for every request
Can I use HTTP or HTTPS with SSE-C?
You must use HTTPS
How does Client Side Encryption work?
Client must handle the keys and encryption/decryption cycle themselves
Are there any helpful libraries to use with Client Side Encryption?
Amazon S3 Encryption Client
What is Encryption in flight known as?
SSL/TLS
What are 2 options for S3 security?
- User based IAM policies
- Resource based bucket policies and ACLs
What are 2 conditions that allow a principal to access an s3 object?
- The users IAM permissions allow it or the resource policy allows it
- And there is no explicit DENY
What does an S3 website url look like?
bucketName.s3-website-us-east-1.amazonaws.com
What should I do if my S3 static website returns 403?
Make sure the bucket policy allows public reads
What is CORS?
Cross Origin Resource Sharing
What is an origin?
It is a protocol, domain and port
How can I resolve CORs issues?
The requests will be fulfilled when the origin allows it by setting the COORs headers.
What are the CORs headers?
Access-Control-Allow-Origin
What is the consistency model in S3?
It is now Strongly consistent
