Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Aye Dub S Ess AA Exam > Simple Storage Service > Flashcards

Simple Storage Service Flashcards

1
Q

When creating an S3 Bucket, who can access it?

A

ONLY the Root User

S3 is completely private by default - just because a bucket is enabled, doesn’t mean it’s publicly accessible.

You must explicitly allow this via a bucket policy or an identity policy otherwise there is the inherent implicit DENY.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an S3 Bucket Policy?

A

This is a Resource Policy attached to a bucket which grants or denies access to that bucket or objects within that bucket.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the difference between RESOURCE policy and IDENTITY policy?

A

Resource based policies are basically inline policies but applied to an AWS Resource instead of a user (like S3 or KMS or SQS or SNS etc)

Identity Policies only work for identities (Principle) within the same AWS account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

REVIEW:

A good way to tell if a Policy is a resource policy or an identity policy is the presence of a Principal (the identity that the policy applies to) within the policy statement.

A

If it’s present –> it’s probably a Resource Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many bucket policies can be attached to an S3 bucket?

A

Only ONE bucket policy, but there can be multiple statements within that policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the “Block Public Access” setting when creating a bucket?

A

Allows you to create an “Open” bucket policy but only for valid AWS Identities - not for Public Access.

Anonymous users will still not have access even though the bucket is public.

Public access is granted to buckets and objects through access control lists (ACLs), bucket policies, or both. In order to ensure that public access to all your S3 buckets and objects is blocked, turn on “block all public access” at the account level. These settings apply account-wide for all current and future buckets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can you host Static Websites on S3?

A

Yes - S3 is great for static website hosting.

Offloads compute resources needed to generate changes/files/etc. and is also much cheaper.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When are you charged for Data in S3?

A

You are not charged for data going IN, only for data going OUT as well as anytime you retrieve data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Object Versioning?

A

When you modify an existing Object within a bucket, a new version is created and made the “current version” of that object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Is Object Versioning turned on by default?

Can you turn it OFF if so?

A

NO - it is DISABLED by default, and once it is ENABLED you can never go back to the disabled state on that bucket. If you want to permanently disable it, you just save the images, delete the bucket and re-upload to a new bucket.

You can however SUSPEND the feature, and once it is suspended it can go back into the ENABLED state.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What happens when you DELETE an object in a bucket with versioning turned on?

A

The object becomes hidden and S3 will add a “Delete Marker” which becomes the current version.

Keep in mind the objects are still there which costs $$. You have to permanently delete the objects by specifying an Object ID.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is MFA Delete (in S3)?

A

Prompts S3 to require an MFA authentication in order for a user to delete an object.

This can help to avoid accidentally modifying/deleting important objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Single PUT Upload?

How big can the upload be?

A

This is default when uploading to S3.

The data get’s uploaded in a single “blob” or stream, of up to 5GB. If that stream fails for whatever reason, you must re-upload the entirety of that file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Multi-part Upload?

A

Breaking up a single “blob” of data into smaller chunks to then upload in multiple streams.

This improves speed and also reliability - if any of the smaller streams fail, that piece can re-upload in isolation versus having to re-upload the entire file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the specs of a Multi-part Upload?

A
  • minimum size of ORIGINAL blob of data is 100MB
  • maximum of 10K smaller streams
  • streams range from 5MB to 5GB
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is S3 Transfer Acceleration?

A

Uploads & frequently accessed data is sent to Edge Locations instead of directly to S3. This way, the data will traverse Amazon’s CDN network versus going over the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What two types of Encryption methods does AWS have?

Examples of each?

A

Crypto @ Rest - prevents physical theft/tampering. Data stored on shared HW is all encrypted.

Crypto in Transit - protecting data while it’s being transferred from point A to B. Data is wrapped in a tunnel before it is sent off.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Key Terms for Encryption:

Plain Text?
Algorithm?
Key?
Ciphertext?

A

Plain Text - text/images/app that’s human readable

Algorithm - code/math that takes data + a key and and creates encrypted data (ciphertext)

Key - password/handshake

Ciphertext - data that is encrypted by an algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Asymmetric v. Symmetric Encryption

Which key can Encrypt data? What key can Decrypt data?

A

Symmetric - same key is used for encrypt/decrypt on both sides.

Asymmetric - key is not the same on both sides. This involves a PUBLIC and PRIVATE key. PUB key creates ciphertext but can never decrypt - only a PRIVATE key can decrypt data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Key Signing?

What does it provide?

A

Key Signing is a way for Side A to validate the encrypted data being sent from Side B is legit. Key Signing is a way to prove IDENTITY.

21
Q

What is Stenography?

A

The method of hiding encrypted data in something else - such as hidden in an image file/dummy file.

This is like using invisible ink.

22
Q

What is AWS Key Management System (KMS)? What can it handle?

A

This is a public and also regional service that creates, stores, and manages encryption keys.

It can handle Asym/Sym crypto keys and can also handle all the encryption functions - encrypt/decrypt/etc.

KMS generates CMK’s and DEK’s.

23
Q

What are Customer Managed Keys (CMK)?

What does it contain?

A

Logical container/representation of a Master Key. It can be used directly to encrypt/decrypt data.

It contains Metadata about they key such as:

  • key ID
  • key state
  • key description
24
Q

What is a big limitation with CMKs?

A

They can only be used to encrypt/decrypt data no larger than 4KB in size.

25
Q

What are Data Encryption Keys (DEK)?

A

These are used to encrypt/decrypt data larger than 4KB in size. This is how we get around the CMK limitation.

26
Q

KEY CONCEPTS:

  1. CMKs are stored/isolated in KMS and never leave. They are in the region specific to the KMS instance (KMS is a regional service).
  2. There are 2 types of CMKs: AWS-managed (generated automatically) and Customer-managed (created by customer; much more customizable).
  3. CMKs support key rotation: AWS-managed keys rotate every 3-years and Customer-managed CMKs rotate every year by default (optional).
A
  1. CMK’s contain the “key backing” metadata about the current Master Key, and also all the historical data from previous keys (if they key has been rotated).
  2. You can create CMK aliases which can be used as shortcuts to specific CMKs (can be good if you have a ton of CMKs that are customer-managed).
27
Q

Are S3 buckets encrypted?

A

False - Objects inside the bucket can be encrypted (different objects can use different settings) but the bucket itself is not encrypted.

28
Q

What are the 2 main methods of S3 Encryption while data is @ Rest? (Hint: sides that handle the Crypto functions)

** Data in transit is encrypted by default **

A

Client Side Encryption - data is encrypted by the client before it leaves to be uploaded in S3 i.e data is ciphertext the entire time.

Server-side encryption - data is encrypted in transit but arrives to S3 in plaintext. S3 then encrypts the data before it is stored.

29
Q

What are the 3 types of Server-Side encryption in S3?

A
  1. SSE-C - customer provided keys; S3 handles crypto ops and customer handles the keys.
  2. SSE-S3 - AWS manages the keys; this is the most common because customer has no added management overhead with encryption.
  3. SSE-KMS - customer master keys (CMKs) that are held within KMS. The CMKs can be either customer/AWS-managed.
30
Q

S3 Encryption Summary:

A

When uploading an image to S3, you can always access it assuming you have S3 permissions.

When uploading using SSE-S3 or AES256, you can always access assuming you have S3 permissions

When uploading with SSE-KMS, even though you have S3 permissions, you must also have permissions for the CMK (which is KMS-managed) that is being used or you will be denied.

You need KMS and S3 permissions OR you can keep these separate to create what’s called “Role Separation” which allows for more granular policy and manipulation of who has what permissions in S3 when accessing specific data.

–> Ex. A User might have CMK permissions but no Permissions for S3, so they can upload encrypted data but have no access to the Bucket.

31
Q

What are the SIX storage classes of S3?

A
  1. S3 Standard
  2. S3 Standard-IA
  3. S3 One Zone-IA

** these top 3 classes support object availability within milliseconds**

  1. S3 Glacier
  2. S3 Glacier Deep Archive
  3. S3 Intelligent Tiering
32
Q

What’s the default storage tier in S3?

A

S3 Standard - if you don’t specify, it’ll automatically be this tier.

Objects are replicated to minimum 3 x AZs.

33
Q

What’s the minimum duration charge for S3-IA?

A

30 days

34
Q

What’s the retrieval time for S3 Glacier?

Whats the minimum billing duration?

A

3-5 hours but you can also pay for expedited retrieval which can take minutes (significant cost).

Minimum duration is 90-days.

35
Q

What’s the retrieval time for S3 Glacier Deep Archive?

A

12-hours and there is no Expedite option.

36
Q

What is S3 Intelligent Tiering?

A

Combines S3-Standard and S3-IA with some automation for moving objects between the two tiers.

Any object that hasn’t been accessed in 30 consecutive days get’s moved to the IA tier which has a much lower cost associated to storing the data.

37
Q

What are Lifecycle Policies?

A

These are sets of rules that you can apply to S3 buckets for the lifecycle of the objects within the bucket.

Ex - After 90 days, move object from S3-standard to S3-IA, and then after another 180 days, move it to Glacier.

or

Ex - after 365 days of the object not being accessed, purge the object so that you can save on cost since it has no more use/is not being used.

38
Q

REVIEW - Replication:

→ Replication is NOT retroactive - only when Replication is turned ON will objects begin replicating.. If there are objects already in the source bucket when turned on, they will not be copied to the desty bucket, only objects that are added after will be copied.

→ Source and Desty buckets both need to have Versioning enabled for Replication

→ This is a ONE-WAY process only i.e from SOURCE to DESTY (not bi-directional)

→ Can handle objects that are unencrypted or encrypted (SSE-S3 and SS3-KMS) i.e no objects with SSE-C (customer managed keys)

A

→ Owner of Source bucket needs permissions to those objects that will be replicated

→ NO replication of system events (only User events) and also NO replication to Glacier or Glacier Deep Archive

→ DELETES are not replicated i.e if you Delete in the Source bucket, it will not be deleted in the Desty bucket
○ It also doesn’t copy “Delete Markers” –> when you delete objects with Versioning enabled, it keeps the objects but adds a delete marker on the source bucket. That marker is also not replicated over to the Destination bucket
○ You have to manually go in and delete all objects + versions from both buckets to actually delete everything

39
Q

What is a Pre-Signed URL?

A

This is a method that gives temporary access to an S3 bucket.

Admin creates list of parameters/rules, send them to S3, and S3 sends back a URL. The person who get’s this URL will have the same exact access to the bucket/objects as the Admin does up until the URL expires.

Once expired the access is gone.

40
Q

What is S3 Glacier Select?

A

This is a method that allows a user to retrieve/restore smaller parts of a large object.

Avoids lengthy time and also full transfer fees for the entire object, when you might only need to access a small or specific part of it.

41
Q

When using S3/Glacier Select, where is the filtering performed? Why is this beneficial?

A

The filter point is placed inside the S3 service itself - S3 can take the SQL-like query and apply it to the raw data inside S3 before transferring it out to an App or the end user.

Without this, the filtering would be done by the App but you’d still be charged for the $$ + time for the full object. The parts you didn’t request simply et discarded.

42
Q

EXAM POWER UPS:

→ If you’re granting/denying permissions on lots of different resources across AWS accounts then you use IDENTITY POLICIES (these policies get attached to Users, Groups, or Roles)

→ IAM is the only single place in AWS where you can control the permissions for everything; most permissions control are done with IAM (Users/Roles/Groups)

→ You can use bucket or resource policies in general if you’re managing permissions on a specific product (like S3)

→ External/anonymous identities accessing resources - you must use a resource policy (i.e they are not an IAM user or AWS user)

→ Do NOT use ACLs unless you absolutely have to.. AWS is phasing out ACLs

A

→ AES-256 is the encryption algorithm used when selecting SSE-S3 as the default encryption method

→ Presigned URLs:

○ You can create a presigned URL for an object that you have no access to; you just need to specify a particular object and an expiration date
§ Because you have no access to the object and the URL is linked to you - anyone who uses it will also not have access to the object

○ When you use the generated URL - your permissions to the bucket/object match the identity that created it at that exact point in time when trying to access
§ Ex - someone creates a URL for an object that they have access to, but the access is all of a sudden revoked, the user of that URL will also all of a sudden have no access either

○ DO NOT generate presigned URLs with an IAM Role — remember, IAM Roles use temporary credentials so any URLs that get created and assume the IAM Role identity will also expire when the Role’s credentials expire. These typically expire way before a presigned URL credential would

43
Q

Which steps are required to allow an S3 bucket to operate as a website?

A 
○ Upload web files
○ Set index and error documents 
○ Enable static website hosting 
○ Disable/block public access settings 
○ Add a bucket policy
44
Q

What is the default limit of the number of S3 buckets in an AWS account?

A

100

45
Q

What are S3 Events?

A

Notification feature enables you to receive notifications when certain events happen in your bucket.

46
Q

How can S3 Events play into an Event-Driven ARCH?

A

Sends a notification based on a triggered event to either SNS, SQS, or Lambda to execute an action.

47
Q

What is the alternative to S3 Events?

Which of the 2 options is preferred?

A

EventBridge

You should always default to EventBridge unless there is a specific reason not to/to use S3 Events

48
Q

What are S3 Access Logs?

A

Provides detailed records for the requests that are made to a bucket.

49
Q

What are 2 use cases for S3 Server Access Logs?

A

○ access log information can be useful in security and access audits

○ It can help you learn about your customer base and understand your Amazon S3 bill.

Aye Dub S Ess AA Exam (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions