Skip to main content

S3

  • Infinitely scaling storage.
  • USE CASES:
    • Backup & Storage
    • Disaster Recovery
    • Archive
    • Hybrid Cloud Storage
    • Application Hosting
    • Media Hosting
    • Data Lakes & Big Data Analytics
    • Software Delivery
    • Static Website

Buckets​

  • Pretty much a directory.
  • Buckets are defined at region level.
  • Names have to globally unique (across all regions and all accounts).
    • Account Regional Namespace - allows for reuse of the same bucket name across regions.
    • No uppercases or underscores, not an IP, has to start with a lowercase letter or number, can't start with the prefix xn--, and must not end with the suffix -s3alias.

Objects​

  • Another word for file.
  • Each object has a key, which is the FULL path to the object, composed of prefix + object name.
  • The value of the object is the file content.
  • Max. object size is 50TB
  • If uploading more than 5GB, must use "multi-part upload".
  • Can have Metadata, Tags and a Version ID.

Security​

  • User Based IAM Policies.
  • Resource Based Bucket Policies: Bucket wide rules from the S3 console - allows cross account.
  • Object ACL - finer grain (can be disabled).
  • Bucket ACL - less common (can be disabled).
  • An IAM principal can access an S3 object if the user IAM permissions ALLOW it or the resource policy ALLOWS it and if there's no explicit DENY.

Bucket Policies​

EXAMPLE:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "PublicRead",
			"Effect": "Allow",
			"Principal": "*",
			"Action": [
				"s3:GetObject"
			],
			"Resource": [
				"arn:aws:s3:::examplebucket/*"
			]
		}
	]
}
  • Use S3 bucket policy to:
    • Grant public access to bucket.
    • Force objects to be encrypted at upload.
    • Grant access to another account (Cross Account).

Versioning​

  • Happens at the bucket level.
  • It is best practice to version your buckets.
    • Protect against unintended deletes
    • Rollbacks
  • Any version prior to having versioning enabled will be null.

Replication​

  • Cross Region Replication (CRR)
    • Compliance, lower latency access, replication across accounts.
  • Same Region Replication (SRR)
    • Log aggregation, live replication between production and test accounts.
  • Buckets can be in different AWS accounts
  • Copying is asynchronous
  • Must give proper IAM permissions to S3.
  • Once replication is enabled, only new objects are replicated.
  • To replicate existing objects and objects the failed replication, use S3 Batch Replication
  • For DELETE ops:
    • Can replicate delete markers from src to dest (optional setting).
    • Deletions with a version ID are not replicated (to avoid malicious deletes).
  • There is no "chaining" of replication:
    • If bucket 1 has replication into bucket 2, which has replication into bucket 3.
    • Then objects created in bucket 1 are not replicated into bucket 3.