S3 - MFA Delete/Access Logs/Glacier Vault Lock & Object Lock Flashcards
What is the primary purpose of MFA Delete?
To provide extra protection against the permanent deletion of object versions and to prevent accidental or malicious changes to Versioning settings.
Who can enable or disable MFA Delete on a bucket?
Only the bucket owner (root account) can enable or disable MFA Delete.
What must be enabled on a bucket to use MFA Delete?
Versioning must be enabled on the bucket.
When is MFA required in Amazon S3 when MFA Delete is enabled?
Permanently deleting an object version.
Suspending Versioning on a bucket.
What is the purpose of S3 Access Logs?
To log all requests made to an S3 bucket, whether authorized or denied, for audit and analysis purposes.
Where are S3 Access Logs stored?
In a separate S3 bucket (called the logging bucket) in the same AWS region.
What can you use to analyze S3 Access Logs?
You can analyze the logs using tools like Amazon Athena.
What is a critical warning about the logging bucket?
Never set the logging bucket to be the same as the monitored bucket, as this will create an infinite logging loop and significantly increase costs.
What is a pre-signed URL for S3?
Users are given a URL which inherits the permissions of the user that generated the URL. This is so they can access objects within the bucket. You can enable from 1-720 minutes.
What is the purpose of S3 Glacier Vault Lock?
To enforce a Write Once Read Many (WORM) model by locking Glacier Vaults, preventing objects from being modified or deleted.
How do you enable S3 Glacier Vault Lock?
Create a Vault Lock Policy.
Lock the policy to prevent future edits.
What are the key benefits of S3 Glacier Vault Lock?
Ensures compliance and data retention.
Prevents objects from being deleted or modified by any user, including administrators.
What is S3 Object Lock, and how does it differ from Glacier Vault Lock?
S3 Object Lock applies at the object level, not the bucket level.
Supports a WORM model for individual object versions.
What must be enabled on a bucket to use S3 Object Lock?
Versioning must be enabled.
What are the two retention modes for S3 Object Lock?
Compliance Mode:
Object versions cannot be deleted or overwritten by any user, including the root user.
Retention modes and periods cannot be changed or shortened.
Governance Mode:
Most users cannot delete or overwrite object versions.
Admins with special IAM permissions can modify retention settings or delete objects.
