S3 Flashcards
What type of storage is S3?
Object storage
What are S3 use cases?
Backup and storage
Disaster Recovery
Archive purposes
For hybrid cloud storage
Application hosting
Media Files
Data lakes y big data analytics
Software updates delivery
Hosting static websites
Where does S3 store objects in?
Buckets
What characteristics must a bucket name have?
It must be globally unique
Where are buckets located in aws?
In a specific region
Is S3 a Global Service?
No. Buckets are located in a region.
What is the naming convention for S3 buckets?
No uppercase.
No undesrcore.
Between 3 and 63 characters long.
Not an IP. Must start with lowercase letter or number.
Must not start with xn
Must not end with s3alias
Example name: bucket-leito123
What is the S3 object key?
The full path of the file (object)
Example: s3://my-bucket/my_file.txt
Example of key with directories (not really directories):
s3://my-bucket/my_folder1/another_folder/my_file.txt
Remember, the s3 UI makes it look like there are directories inside a bucket, but in reality there are just different keys, and some are longer and have / slashes, like the previous example: “/my_folder1/another_folder/”
The /my_folder1/another_folder/ path is just the prefix for the object name.
Key = prefix + object name
Can you have folders in s3?
Yes. Folders can be created inside a bucket to organize a buckets’ objects. The folder will be part of the object key.
What is the key prefix?
Part of the key. The prefix is the part of the patch that consists of the folders the object is in.
Key = Prefix + Object
Are there directories in buckets?
No. In the UI it looks like there are directories. But in reality there are just different keys to the objects inside buckets.
What is the max object size?
5TB
What happens when you upload a file larger than 5GB?
You must use the multi part upload
Why can you open objects with the “open” button in the aws management console, and not the public URL?
Because when you open an object with this button, aws verifies your user is the one opening it and it signs the request with your user, which owns the object.
What is an S3 object URL?
Every S3 object has a public access URL. To which you need to enable access. Objects are not public by default.
How does security work in S3?
Security is centered around access to S3 objects.
It can be user based or resource based.
User based security is for bucket objects, and it uses IAM Policies to set which api calls should be allowed for a specific user from IAM
Resource based security are bucket wide rules that you can assign them from the s3 console. These rules can allow a specific user to have access, and it is even cross account. So it can allow users from other AWS Accounts to have access to the bucket
What is resource based security in S3?
Resource based security contains the following:
Bucket Policies: These are bucket wide rules that you can assign from the s3 console. These rules can allow a specific user to have access, and it can even be cross account. So it can allow users from other AWS Accounts to have access to the bucket.
Object ACLs: A finer grained security for bucket objects. These can be disabled.
Bucket ACLs: Less common. And can be disabled.
What is user based security in S3?
User based security is for s3 in general. It uses IAM Policies to set which api calls should be allowed for a specific user from IAM.
What are Object ACL?
A finer grained security for bucket objects.
What is a principal?
That to which a permission or role applies to. A user or a resource
A principal can access an s3 object if?
If the user IAM permissions allow it, OR, if the resource policy allows it, AND, there is no explicit deny.
Can you use encryption in s3?
Yes. You can encrypt objects using encryptions keys.
What are S3 bucket policies made of?
JSON document. Very similar to IAM Policies.
How can you force objects to be encrypted at upload in s3?
With a bucket policy.
What can you use a bucket policy for?
Force objects to be encrypted.
Grand a bucket public access.
Grant access to another account to a bucket (Cross Account).
How do you grant an EC2 instance access to an S3 Bucket?
With an IAM Role.
How do you grant a user in another account access to my bucket?
With a bucket policy
What are default scurity settings for a bucket?
Block all public access is on. You need to disable it to allow public access to your bucket. This will block any access granted by bucket policies or ACLs.
How does an s3 bucket policy look like?
Its like an IAM policy, with a statement. Here the principal is a , which means anyone. The action is s3:GetObject which is view. And the resource is the bucket with a /, which means any object inside the bucket. The resource could be arn:aws:s3:::leito-bucket/coffee which will only make public the coffee picture within the bucket.
{
“Version”: “2012-10-17”,
“Id”: “Policy1727063555175”,
“Statement”: [
{
“Sid”: “Stmt1727063553042”,
“Effect”: “Allow”,
“Principal”: “”,
“Action”: “s3:GetObject”,
“Resource”: “arn:aws:s3:::leito-bucket/”
}
]
}
What is s3 hosting?
You can host static websites in s3.
S3 websites look like this:
https://bucket-name.s3-website.aws-region.amazonaws.com
What is an s3 website composed of?
A bucket with files, html files, pictures, etc.
How do you enable static website hosting in s3?
Enter your bucket and in properties you can enable it.
It lets you add a home page html, which will be in your bucket, and an error html too. These htmls can point to pictures or other objects in the bucket.
You will have to enable public access to all the objects in the bucket that the website uses
What is S3 versioning?
You can have multiple versions of objects in a versioning enabled bucket.
What happens when you overwrite a key in a versioning enabled bucket?
It automatically makes another version
What happens when you delete a key in a versioning enabled bucket?
It doesn’t delete. It adds a “delete marker” and lets you restore the deleted version.
What is a version rollback?
You have an object in version 3, you can go back to version 2 easily.
Do you lose versions with “suspend versioning”?
No. You just stop versioning files, you dont lose previous versions.
What version do objects that are previous to enabling versioning, and that have not been versioned have?
Null.
What happens when you upload a file with the same name to an s3 bucket?
If you don’t have versioning, the object is overritten. If you have versioning, a new version is created.
What is version id?
A unique identifier for a version of an object
How do you roll back an object change in s3?
You delete the latest version of the object.
What happens when you delete an object in an s3 bucket with versioning enabled?
When you delete an object, it adds a delete marker on it, and hides it from the object list. It doesn’t actually delete it.
If you want to permanently delete an object, you have to delete all versions of it, with the versions toggle enabled.
You can permanently delete only certain versions of an object.
What is a delete marker?
It’s like a version of an object S3 adds when you delete an object with versioning enabled. It hides the object from the list and “protects” and makes unavailable its versions.
How do you undo deleting an object in an s3 bucket with versioning enabled?
By deleting the delete marker.
What are the 2 possibilities with s3 replication
Cross region replication and Same region replication
What are some s3 cross region replication use cases?
To grant lower latency access to data.
For replication across aws accounts
For company compliance
What are the characteristics of s3 replication?
Asyncronous
From an origin bucket to a destination bucket, in same or different region, and in same or different aws account.
Must enable versioning in origin and destination buckets
CRR or SRR option
What are some s3 same region replication use cases?
For log aggregation (Process of consolidation log data from various sources of an environment).
Live replication from production to test accounts. (For test environments).
