S3 Flashcards
What is Simple Storage Service (S3)?
An object-based storage. Store unlimited data without worry of underlying storage infrastructure
Across how many AZs is the data replicated across?
3 to ensure 99.99% availability and 11’ 9’s of durability
What can objects contain?
any type of data
What are the size limits for Objects
“0 Bytes up to 5 Terabytes
up to 5GB in a single PUT
for larger objects use Multipart upload”
What can Buckets contain?
objects and folders
What are the naming rules for S3 buckets?
They must be unique across all AWS accounts
What status code do you get from a succesful upload to an S3 bucket?
HTTP 200 code
What is the Lifecycle Management feature
Automatically deletes or moves objects between storage classes based on a schedule
What is the Versioning feature
“Objects are given a Version ID
Old objects are not removed upon upload of new objects
Old objects can be accessed via their Version ID
Deleting a newer version object restores the previous version
Once Versioning is activated it cannot be turned off only suspended”
What is the MFA Delete feature?
“Multi-Factor Authentication Delete
Delete operations require MFA token
Versioning must be turned on
MFA delete function can only be activated via the AWS CLI
Root account is allowed to delete objects”
What is the default bucket public access setting?
Private
What logging options do S3 buckets have?
“CloudTrail
Object-level logging to track operations performed on objects
CloudWatch
Monitor requests in your bucket”
Where do you configure a buckets Access control?
“Bucket Policies requiring a JSON
Access Control Lists(ACL) GUI”
Bucket Policy vs ACL
“Bucket Policies are complex and allow more customization
ACL’s are simplified and offer limited customization”
What is the SSE feature? How many options does SSE offer?
“Server Side Encryption
currently 3 options”
SSE-AES vs SSE-KMS vs SSE-C
“SSE-AES
AWS handles the key and uses Advanced Encryption Standard(AES)-256 algorithm
SSE-KMS
Envelope encryption via AWS Key Management System(KMS) managed by you
SSE-C
Customer provided key (you manage the keys)”
What is Client-Side Encryption?
“The practice of encrypting files before uploading them to the S3
This is not a feature just a common practice”
What is the Cross Region Replication (CRR) feature?
“Allows replication across regions for greater durability
Must have Versioning turned on
Can have CRR replicate to a bucket in another AWS account”
What is the Transfer Acceleration feature?
“Provides faster and more secure uploads from anywhere in the world
Data is uploaded via a distinct url to an Edge Location
(Edge Locations refer to the zone or region from which the end user accesses the service)
Data is transfered via the AWS backbone network”
What is the Presigned Urls feature?
“A url is generated via the AWS CLI or SDK ot provide temporary access to write or download object data
This is a common way to provide access to private objects”
What are an S3 bucket’s properties?
"Versioning Server access logging Static website hosting Object-level logging - using CloudTrail Tags Transfer accelerations Events"
What is the storage class feature?
An object level feature providing different storage options
What are the storage class’s offered?
"Standard Standard-IA(infrequent access) Intelligent-Tiering One Zone-IA Glacier Glacier Deep Archive"
What is metadata?
"An object level feature providing system metadata.
Date
Content-Length
x-amz-server-side-encryption
x-amz-version-id
x-amz-storage-class"What is the eventual consistency feature?
“Overwrite PUTS and DELETES remain in the bucket until the deletion is fully propagated
GETS could list an object before the PUT or DELETE takes place”
What is read-after-write consistency?
“New objects added in US Standard region rule:
PUTS of new objects are immediatly accessable
unless HEAD or GET directly proceeds PUT of new object”
system vs user meta data
“System - can only be altered by the system
User - can be altered by either the system or the user
All optional user-defined metadata names begin with x-amz-meta-“
What feature do you need to enable for writing logs into an S3?
“public access to the bucket is not required
PutObject access for Log Delievery group”
What is the Log Delivery Group?
A special delivery account provided by AWS that controls access restrictions when using logging
What are valid url patterns for S3 buckets?
“Virtual hosted style - bucket.s3.aws-region.amazonaws.com
Path style - s3.aws-region.amazonaws.com/bucket”
What is a delete-marker?
When using versioning if you delete an object the version is kept in record but is marked to indicate it should not be used as the current version
How do you permenantly delete a version from an object?
You must specifically delete the object by VersionId
glacier retrieval times
The vault lock and standard retrieval are standard with 3 to 5 our retrieval time. bulk retrievals which can be considered the cheapest option have a 5 to 12 our retrieval time. expedited retrievals allow access in 125 minutes for a flat rate of $0.03/gb
OAI and permission best practice
Create and OAI user to associate with distribution and modify permission on S3 bucket using object ACL’s
