AWS Solutions Architect

AWS Certification Roadmap

720 / 1000 to pass 

aws sts get-caller-identity 

S3 

• AWS S3 CLI

• AWS-S3-Bash-Scripting 

What is in S3 Object? 

Key: this is the name of the object 

Value: the data itself made up of a sequence of bytes 

Version ID: when versioning enabled, the version of object 

Metadata: additional information attached to the object 

What is S3 Bucket? 

Bucket hold objects. Buckets can also have folders which in turn hold objects.

You can store an individual object from 0 Bytes to 5 Terabytes in size 

S3 Encryption type: By default Amazon S3 managed keys (SSE-S3) 

aws s3api create-bucket --bucket my-example-bucket-my --region us-east1 

aws s3api list-buckets 

aws s3api list-buckets --query Buckets[].Name --output table 

aws s3api list-buckets --query "Buckets[?Name == 'kuyil-w2'].Name" --output text 

aws s3 sync images/ s3://my-example-bucket-my 

aws s3api get-object --bucket my-example-bucket-my --key hello.txt world.txt 

aws s3api put-object --bucket my-example-bucket-my --key world.txt --content-type plain/txt --body world.txt 

aws s3api list-objects --bucket my-example-bucket-my --query Contents[].Key 

Create a Bucket

aws s3api create-bucket --bucket my-example-bucket-ab --region us-east-1 

List All Buckets

aws s3api list-buckets --query "Buckets[].Name" 

Upload a Single Object

aws s3 cp path/to/local/file.txt s3://my-example-bucket-ab/ 

Upload Multiple Objects Using Sync

aws s3 sync path/to/local/directory/ s3://my-example-bucket-ab/ 

Download a Single Object

aws s3 cp s3://my-example-bucket-ab/file.txt path/to/local/directory/ 

Download Multiple Objects Using Sync

aws s3 sync s3://my-example-bucket-ab/ path/to/local/directory/ 

List Objects in a Bucket

aws s3api list-objects --bucket my-example-bucket-ab --query "Contents[].Key" 

When listing objects, folder names end with a /. You can exclude these from the results by applying a JMESPath query. The command to achieve this is as follows:

aws s3api list-objects --bucket my-example-bucket-ab --query 'Contents[?(!ends_with(Key, `/`))].Key' 

Delete a Single Object

aws s3 rm s3://my-example-bucket-ab/file.txt 

Delete All Objects in a Bucket Recursively

aws s3 rm s3://my-example-bucket-ab/ --recursive 

Delete an Empty Bucket

aws s3api delete-bucket --bucket my-example-bucket-ab 

Get Object Metadata

aws s3api head-object --bucket my-example-bucket-ab --key file.txt 

Enable Versioning on a Bucket

aws s3api put-bucket-versioning --bucket my-example-bucket-ab --versioning-configuration Status=Enabled 

AWS-S3-Bash-Scripting 

./334_aws_create_s3.sh  cadent-ops-test2 

#!/bin/bash

# myom@cadent.tv 01-2025

# Check for bucket name

if [ -z "$1" ]; then

     echo "There needs to be a bucket name eg. ./334_aws_create_s3.sh my-bucket-name"

     exit 1

fi

aws s3api create-bucket --bucket $1 

./335_aws_list_bucket_s3.sh cadent-ops-test2 

#!/bin/bash

# myom@cadent.tv 01-2025

# Check for bucket name

if [ -z "$1" ]; then

     echo "There needs to be a bucket name eg. ./334_aws_create_s3.sh my-bucket-name"

     exit 1

fi

aws s3api list-buckets --query "Buckets[?Name == '$1'].Name" --output text

./336_aws_list_all_bucket.sh 

#!/bin/bash

# myom@cadent.tv 01-2025

# Check for bucket name

#if [ -z "$1" ]; then

#     echo "There needs to be a bucket name eg. ./334_aws_create_s3.sh my-bucket-name"

#     exit 1

#fi

aws s3api list-buckets

./337_aws_delete_one_bucket.sh cadent-ops-test2 

#!/bin/bash

# myom@cadent.tv 01-2025

# Check for bucket name

if [ -z "$1" ]; then

     echo "There needs to be a bucket name eg. ./334_aws_create_s3.sh my-bucket-name"

     exit 1

fi

aws s3api delete-bucket --bucket $1

List latest buckets

aws s3api list-buckets | jq -r '.Buckets | sort_by(.CreationDate) | reverse | .[] | .Name' 

List only one latest bucket 

aws s3api list-buckets | jq -r '.Buckets | sort_by(.CreationDate) | reverse | .[0] | .Name'

#!/bin/bash

echo "== sync"

# Exit immediately if any command returns a non-zero status

set -e 

# Check for bucket name

if [ -z "$1"]; then 

  echo "There needs to be a bucket name"

  exit 1

fi 

# Check for filename prefix 

if [ -z "$2"]; then 

  echo "There needs to be a file name"

  exit 1

fi 

BUCKET_NAME=$1

FILENAME_PREFIX=$2 

# Where we'll store these files

OUTPUT_DIR="/tmp/s3-bash-scripts"

rm -rf $OUTPUT_DIR 

mkdir -p $OUTPUT_DIR 

# Generate a random number 

# to determine how many files to create 

NUM_FILES=$((RANDOM % 6 + 5))

for ((i=1; i<=$NUM)FILES; i++)); do

   # Generate a random filename 

   FILENAME="$OUTPUT_DIR/${FILENAME_PREFIX_$1}.txt"

   # Generate random data and write it to the file

   dd if=/dev/urandom of="$FILENAME" bs=1024 count=$((RANDOM % 1014 + 1)) 2>/dev/null

done

tree $OUTPUT_DIR 

#!/bin/bash

echo "== put-object" 

# Check for bucket name

if [ -z "$1"]; then 

  echo "There needs to be a bucket name"

  exit 1

fi 

# Check for filename prefix 

if [ -z "$2"]; then 

  echo "There needs to be a file name"

  exit 1

fi 

BUCKET_NAME=$1

FILENAME=$2

OBJECT_KEY=$(basename "$FILENAME")

aws s3api put-object \

--bucket $BUCKET_NAME \

--body $FILENAME \

--key $OBJECT_KEY

./put_object_s3 my-s3-bucket /tmp/newfile.txt 

#!/bin/bash

echo "== delete-object" 

# Exit immediately if any command returns a non-zero status

set -e 

# Check for bucket name

if [ -z "$1"]; then 

  echo "There needs to be a bucket name"

  exit 1

fi 

# Check for filename prefix 

if [ -z "$2"]; then 

  echo "There needs to be a file name"

  exit 1

fi 

BUCKET_NAME=$1

aws s3api list-objects-v2 \

--bucket $BUCKET_NAME) \

--query Contents[].Key \

| jq -n '{Objects: [inputs | .[] | {Key: .}]}' > /tmp/delete_objects.json

aws s3api delete-objects --bucket $BUCKET_NAME --delete file:///tmp/delete_objects.json 

# This will delete all objects in my S3

./s3_delete_objects.sh my-s3-bucket 

Create a bucket

#!/bin/bash

set -e

if [ -z "$1" ]; then

    echo "No bucket name provided. Usage: $0 bucket-name"

    exit 1

fi

BUCKET_NAME=$1

REGION=${2:-us-east-1}

aws s3api create-bucket --bucket "$BUCKET_NAME" --create-bucket-configuration LocationConstraint="$REGION"

Delete a bucket 

#!/bin/bash

set -e

if [ -z "$1" ]; then

    echo "No bucket name provided. Usage: $0 bucket-name"

    exit 1

fi

BUCKET_NAME=$1

aws s3api delete-bucket --bucket "$BUCKET_NAME"

Generate Random Files

#!/bin/bash

set -e

OUTPUT_DIR="./temp"

mkdir -p $OUTPUT_DIR

rm -rf $OUTPUT_DIR/*

NUM_FILES=$((RANDOM % 6 + 5))

for i in $(seq 1 $NUM_FILES); do

    FILE_NAME="$OUTPUT_DIR/file_$i.txt"

    head -c 100 </dev/urandom > $FILE_NAME

    echo "Created $FILE_NAME"

done

Sync Files 

#!/bin/bash

set -e

if [ -z "$1" ]; then

    echo "No bucket name provided. Usage: $0 bucket-name"

    exit 1

fi

BUCKET_NAME=$1

FILE_PREFIX=${2:-files}

aws s3 sync ./temp s3://$BUCKET_NAME/$FILE_PREFIX

List Objects

#!/bin/bash

set -e

if [ -z "$1" ]; then

    echo "No bucket name provided. Usage: $0 bucket-name"

    exit 1

fi

BUCKET_NAME=$1

aws s3api list-objects --bucket "$BUCKET_NAME" --query 'Contents[].{Key: Key, Size: Size}'

Delete All Objects

#!/bin/bash

set -e

if [ -z "$1" ]; then

    echo "No bucket name provided. Usage: $0 bucket-name"

    exit 1

fi

BUCKET_NAME=$1

OBJECTS=$(aws s3api list-objects --bucket "$BUCKET_NAME" --query 'Contents[].{Key: Key}' --output json)

if [ "$OBJECTS" == "null" ]; then

    echo "Bucket is empty"

    exit 0

fi

echo '{"Objects":' > delete.json

echo $OBJECTS | jq '.' >> delete.json

echo '}' >> delete.json

aws s3api delete-objects --bucket "$BUCKET_NAME" --delete file://delete.json

rm delete.json

Get Newest Bucket

#!/bin/bash

aws s3api list-buckets --query 'Buckets | sort_by(@, &CreationDate) | [-1:].Name' --output text

Cloud Formation (cfn) Infrastructure as code 

#!/bin/bash

echo "== deploy s3 bucket via CFN"

STACK_NAME="cfn-s3-simple"

aws cloudformation deploy \

--template-file template.yaml \

# You have to log into AWS console Cloudformation -> Stack and accept the change

--no-execute-changeset \

--region us-east-1 \

--stack-name $STACK_NAME

#!/bin/bash

echo "== delete stack for s3 bucket via CFN"

STACK_NAME="cfn-s3-simple"

aws cloudformation delete-stack \

--region us-east-1 \

--stack-name $STACK_NAME

Terraform 

wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

sudo apt update && sudo apt install terraform

search terrafom registry -> Use Provider 

myom@b-ea1c-ansible-2023:~/aws/Terraform$ cat main.tf

terraform {

  required_providers {

    aws = {

      source = "hashicorp/aws"

      version = "5.84.0"

    }

  }

}

provider "aws" {

  region = "us-east-1"

}

Creates random bucket name

myom@b-ea1c-ansible-2023:~/aws/Terraform$ cat s3.tf

resource "aws_s3_bucket" "my-test" {

 #bucket = "cadent-cops-test12"  

  tags = {

    Name        = "My bucket"

    Environment = "Dev"

  }

}

terraform init 

terraform plan 

terraform apply 

terraform destroy

CDK (AWS Cloud Development Kit)

sudo npm i -g aws-cdk 

cdk init cdk --lanuage=typescript 

Pulumi

S3 Bucket Overview

S3 Bucket Overview

S3 Buckets are infrastructure, and they hold S3 Objects

• S3 Bucket Naming Rules – how we have to our name bucket

• S3 Bucket Restrictions and Limitations – What we can and can’t do with buckets

• S3 Bucket Types – the two different kinds of buckets, flat (general purpose) and directory

• S3 Bucket Folders – How S3 Buckets has virtual folders for general purpose buckets

• Bucket Versioning – how we can version of all objects

• Bucket Encryption – how we can encrypt the contents of bucket

• Static Website Hosting – How we can let our buckets host websites

What is the purpose of bucket encryption in Amazon S3? (To encrypt the contents of the bucket)

What are the two different kinds of S3 bucket types? (Flat (general purpose) and directory)

How does S3 bucket versioning benefit data management? (S3 bucket versioning allows multiple versions of an object to be stored in a bucket, enabling data recovery and protection against accidental deletion or overwriting.)

S3 Bucket Naming Rules

S3 Buckets Names are similar to valid URL rules (but more rules), this is because S3 bucket names are used to form URL links to perform various HTTPs operations.

https://myexamplebucket.s3.amazonaws.com/photo.jpg

• Length: Bucket names must be 3-63 characters long.

• Characters: Only lowercase letters, numbers, dots (.), and hyphens (-) are allowed.

• Start and End: They must begin and end with a letter or number.

• Adjacent Periods: No two adjacent periods are allowed.

• IP Address Format: Names can't be formatted as IP addresses (e.g., 192.168.5.4).

• Restricted Prefixes: Can't start with "xn--", “s3alias-”, “amzn-s3-demo”, "sthree-", or "sthree-configurator".

• Restricted Suffixes: with "-s3alias“, “--ol-s3”, “--x-s3”, “.mrap” reserved for access point alias names.

• Uniqueness: Must be unique across all AWS accounts in all AWS Regions within a partition.

• Exclusivity: A name can't be reused in the same partition until the original bucket is deleted.

• Partitions: “aws” (Standard Regions), “aws-cn” (China Regions), “aws-us-gov” (AWS GovCloud US)

• Transfer Acceleration: Buckets used with S3 Transfer Acceleration can't have dots in their names.

No Uppercase, No Underscores, No Spaces in Bucket Names

Which of the following characters are NOT allowed in an Amazon S3 bucket name? (Uppercase)

What is the range of characters allowed in an S3 bucket name's length? (An Amazon S3 bucket name must be between 3 and 63 characters long.)

Why is the S3 bucket name 'data..bucket..archive' invalid? (It contains adjacent periods.)

Is the S3 bucket name '123.456.789.012' valid or invalid, and why? (Invalid, because it is formatted as an IP address which is not allowed in S3 bucket naming conventions.)

S3 — Bucket Restrictions and Limitations

• You can, by default, create 100 buckets

  • You can create a service request to increase to 1000 buckets

• You need to empty a bucket first before you can delete it

• No max bucket size and no limit to the number of objects in a bucket

  • Files can be between 0 and 5 TBs

    • Files larger than 100MB should use multi-part upload

  • S3 for AWS Outposts has limits

• Get, Put, List, and Delete operations are designed for high availability

  • Create, Delete or configuration operations should be run less often.

How many S3 buckets can you create by default in AWS? (100) 

What is the recommended upload method for files larger than 100MB in S3? (Multi-part upload)

What should you do before deleting an S3 bucket in AWS? (Before deleting an S3 bucket in AWS, you need to empty the bucket first.)

S3 — Bucket Types

Amazon S3 has two types of buckets:

General purpose buckets

• Organizes data in a flat hierarchy

• The original S3 bucket type

• Recommended for most use cases

• Used with all storage classes except can’t be used with S3 Express

• One Zone storage class

• There aren’t prefix limits

• There is a default limit of 100 general buckets per account

Directory buckets

• Organizes data folder hierarchy

• Only to be used with S3 Express One Zone storage class

• Recommended when you need single-digit millisecond performance on PUT and GET

• *There aren't prefix limits for directory buckets

• Individual directories can scale horizontally

• There is a default limit of 10 directory buckets per account

What is the original S3 bucket type recommended for most use cases? (General purpose buckets) 

When should you use directory buckets in Amazon S3? (Directory buckets should be used when you need single-digit millisecond performance on PUT and GET operations, specifically with the S3 Express One Zone storage class.)

S3 — Bucket Folder

The S3 Console allows you to “create folders”. S3 general purpose buckets do not have true folders found in hierarchy file system.

When you create a folder in S3 Console, Amazon S3 creates a zero-byte S3 object with a name that ends in a forward slash eg. myfolder/

• S3 folders are not their own independent identities but just S3 Objects

• S3 folders don’t include metadata, permissions

• S3 folders don’t contain anything, they can’t be full or empty

• S3 folders aren’t “moved”, S3 objects containing the same prefix are renamed

Which of the following statements is true about folders in Amazon S3? (Folders in S3 are just S3 objects that serve as a means to organize other objects.) 

What does "moving a folder" in Amazon S3 actually entail? (Moving a folder in Amazon S3 involves renaming the S3 objects with a different prefix that corresponds to the new folder path, not physically moving a folder as in traditional file systems.)

S3 Object Overview

S3 Objects are resources that represent data and is not infrastructure.

• Etags — a way to detect when the contents of an object has changed without download the contents

• Checksums — ensures the integrity of a files being uploaded or downloaded

• Object Prefixes — simulates file-system folders in a flat hierarchy

• Object Metadata — attach data alongside the content, to describe the contents of the data

• Object tags — benefits resource tagging but at the object level

• Object Locking — makes data files immutable

• Object Versioning — have multiple versions of a data file

How do Object Tags benefit Amazon S3 users? (They provide a way to categorize and manage resources at the object level.)

What are Etags in Amazon S3 used for? (Etags are used in Amazon S3 to detect changes in an object's content without needing to download the object, aiding in efficient data management and synchronization.)

S3 Objects — ETags

What is an ETag?

An entity tag (etag) is a response header that represent a resource that has changed (without the need to download).

• The value of an etag is generally represented by a hashing function eg. MD5 or SHA-1

• Etags are part of the HTTP protocol.

• Etags are used for revalidation for caching systems.

S3 Objects have an etag

• etag represents a hash of the object

• reflects changes only to the contents of an object, not its metadata

• may or may not be an MD5 digest of the object data (depends if it’s encrypted)

• Etag represents a specific version of an object

ETags are useful if you want to programmatically detect content changes to S3 objects

What is an ETag in the context of S3 objects? (A response header representing a hash of the object that reflects changes in its content) 

What aspect of an S3 object does its ETag reflect changes to? (The ETag of an S3 object reflects changes to the object's content, not its metadata, and represents a specific version of that object.)

resource "aws_s3_bucket" "default" {

}

resource "aws_s3_object" "object" {

  bucket = aws_s3_bucket.default.id

  key    = "myfile.txt"

  source = "myfile.txt" 

  etag   = filemd5("myfile.txt")

}

terraform plan 

terraform apply --auto-approve 

terraform destroy --auto-approve 

S3 Object — Checksums

What is a Checksum?

A checksum is used to check the sum (amount) of data to ensure the data integrity of a file. If data is downloaded and if in-transit data is loss or mangled the checksum will determine this is something wrong with the file.

Amazon S3 uses checksums to verify data integrity of files on the upload or download.

AWS allows you to change the checksum algorithm during uploading an object

Amazon S3 offers the following checksum algorithms

• CRC32 (Cyclic Redundancy Check)

• CRC32C

• SHA1 (Secure Hash Algorithms)

• SHA256

What is the purpose of a checksum in AWS S3? (To ensure the data integrity of a file by verifying its contents.) 

Can the checksum algorithm be altered when uploading files to Amazon S3? (Yes, the checksum algorithm can be altered when uploading files to Amazon S3, allowing users to choose from several algorithms such as CRC32, CRC32C, SHA1, and SHA256.)

aws s3 mb s3://checksum-examples-my-1234

echo "Heelo Mars" > myfile.txt 

md5sum myfile.txt 

aws s3 cp myfile.txt s3://checksum-examples-my-1234

aws s3api head-object --bucket checksum-examples-my-1234 --key myfile.txt 

sudo apt install rhash -y 

rhash --crc32 --simple myfile.txt 

sha1sum myfile.txt 

S3 Object — Prefixes

S3 Object prefixes are strings that proceed the Object filename and is part of the Object key name

Since all objects in a bucket are stored in a flat-structured hierarchy, Object prefixes allows for a way to organize, group and filter objects.

A prefix uses the forward slash “/” as a delimitator to group similar data, similar to directories (folders) or subdirectories. Prefixes are not true folders.

There is no limit for the number of delimitators, the only limit the Object key name cannot exceed 1024 bytes with the object prefix and filename combined.

What is the role of prefixes in Amazon S3? (To organize, group, and filter objects in a bucket) 

Which delimiter is used in S3 object prefixes to create a pseudo-folder hierarchy? (The forward slash (/) is used as a delimiter in S3 object prefixes to simulate directories or subdirectories, helping in grouping similar data.)

aws s3 mb s3://prefixes-fun-ab-5235 

aws s3api put-object --bucket="prefixes-fun-ab-5235" --key="hello/" 

1024 chacter deep 

aws s3api put-object --bucket="prefixes-fun-ab-5235" --key="Lorem/ipsum/dolor/sit/amet/consectetur/adipiscing/elit/Nunc/id/facilisis/dolor/Donec/laoreet/odio/ac/bibendum/eleifend/Ut/nunc/massa/finibus/vitae/hendrerit/ac/aliquam/in/ligula/Vestibulum/eu/nibh/eget/nisl/aliquet/elementum/id/non/massa/Praesent/sed/dolor/facilisis/imperdiet/justo/ut/varius/urna/Cras/lacinia/lacinia/diam/sed/convallis/nisi/vehicula/sit/amet/Mauris/lacinia/rutrum/justo/a/consectetur/dolor/maximus/et/Duis/condimentum/dignissim/ligula/et/sollicitudin/Mauris/non/convallis/nisi/eget/vestibulum/est/Aliquam/faucibus/vestibulum/lacus/vitae/sagittis/nulla/blandit/quis/Vivamus/vel/justo/a/nisi/bibendum/varius/ac/vitae/urna/Nullam/et/lorem/metus/Praesent/lorem/mi/laoreet/eget/tincidunt/et/vestibulum/eget/erat/Aenean/nisl/ante/lobortis/vel/orci/sit/amet/commodo/viverra/mauris/Fusce/at/ipsum/at/ex/facilisis/ultrices/et/vel/augue/Etiam/vitae/nulla/sit/amet/risus/sagittis/pharetra/ullamcorper/vitae/mi/Nullam/eget/mollis/urna/non/malesuada/dui/Morbi/porta/nunc/et/ipsum/libero/wra/dsf/dfs/gf/dhg/gfh/jgidngi/" 

S3 Object — Metadata

What is Metadata?

Metadata provides information about other data but not the contents itself.

Metadata is useful for:

• categorizing and organizing data

• providing content about data

Amazon S3 allows you to attach metadata to S3 Objects at anytime

Metadata can be either:

• System defined

• User-defined

Resource Tags and Object tags are similar to Metadata, but tags are intended to provide information about cloud resources (eg. S3 Objects) and not the contents of the object.

What is the primary purpose of metadata in the context of AWS S3 objects? (To provide information about the data without describing the content itself.) 

What are the two types of metadata that can be attached to an AWS S3 Object? (System-defined and user-defined metadata.)

S3 Object —System Defined Metadata

System Defined Metadata is data that only Amazon can control.

User’s usually* cannot set their values for these metadata values.

• Content Type: image/jpeg

• Cache Control: max-age=3600, must-revalidate

• Content Disposition: attachment; filename='example.pdf’

• Content-Encoding: gzip

• Content-Language: en-US

• Expires: Thu, 01 Dec 2030 16:00:00 GMT

• X-amz-website-redirection-location: /new-page.html

*Some system defined metadata can be modified by the user eg. Content Type

AWS will attach some System defined metadata even if you do not specify any.

Which of the following is an example of AWS S3 System Defined Metadata? (Content Type: image/jpeg)

What is System Defined Metadata in AWS S3? (System Defined Metadata in AWS S3 includes metadata like Content Type, Cache Control, Content Disposition, etc., that is automatically attached by AWS and usually cannot be modified by the user, although there are exceptions like Content Type.

S3 —User Defined Metadata

User Defined Metadata is set by the user and must start with x-amz-meta- eg.

Access and Security:

• x-amz-meta-encryption: "AES-256"

• x-amz-meta-access-level: "confidential"

• x-amz-meta-expiration-date: "2024-01-01"

Media File:

• x-amz-meta-camera-model: "Canon EOS 5D"

• x-amz-meta-photo-taken-on: "2023-06-10"

• x-amz-meta-location: "New York City"

Custom Application:

• app-version: "2.4.1"

• data-imported: "2023-03-15"

• source: "CRM System"

Project-specific:

• x-amz-meta-project-id: "PRJ12345"

• x-amz-meta-department: "Marketing"

• x-amz-meta-reviewed-by: "Jane Smith"

Document Versioning:

• x-amz-meta-version: "v3.2"

• x-amz-meta-last-modified-by: "Alice Johnson"

• x-amz-meta-original-upload: "2023-02-01"

Content-related:

• title: "Annual Sales Report 2023"

• author: "John Doe"

• description: "Detailed sales …"

Compliance and Legal:

• x-amz-meta-legal-hold: "true"

• x-amz-meta-compliance-category: "GDPR"

• x-amz-meta-retention-period: "5 years"

Backup and Archival:

• x-amz-meta-backup-status: "Completed"

• x-amz-meta-archive-date: "2023-04-20"

• x-amz-meta-recovery-point: "2023-04-15"

Which metadata key is used to specify the encryption type for a file stored in Amazon S3? (x-amz-meta-encryption)

In the context of Amazon S3 user-defined metadata, how is the location where a photo was taken specified? (The location where a photo was taken is specified using the key "x-amz-meta-location" in the user-defined metadata.)

aws s3 mb s3://metadata-fun-ab-12421 

echo "Hello Mars" > hello.txt

aws s3api put-object --bucket metadata-fun-ab-12421 --key hello.txt --body hello.txt --metadata Planet=Mars 

aws s3api head-object --bucket metadata-fun-ab-12421 --key hello.txt 

aws s3 rm s3://metadata-fun-ab-12421/hello.txt 

aws s3 rb s3://metadata-fun-ab-12421

What is WORM?

What is WORM?

Write once read many (WORM) is a storage compliance feature that makes data immutable, You write once and the file can never be modified or deleted, but you may read the unlimited times

WORM is useful in healthcare or financial industries where files need to be audited and untampered

An example of WORM are video game cartridges. Where you would write data permanently to a ROM (Read only memory)

You can play the game (read the data) as many times as you want but you can’t change the data.

What does WORM stand for in the context of data storage? (Write Once, Read Many) 

Why is WORM important in industries like healthcare and finance? (WORM is crucial in such industries because it ensures data integrity and immutability, which is vital for audit trails and compliance, preventing tampering and ensuring data remains unchanged.)

S3 Object Lock

S3 Object Locks allows to prevent the deletion of objects in a bucket

This feature can only be turned on at the creation of a bucket

Object Lock is for companies that need to prevent objects being deleted to have:

• Data integrity

• Regulatory compliance

S3 Object Lock is SEC 17a-4, CTCC, and FINRA regulation compliant

You can store objects using a write-once-read-many (WORM) model just like S3 Glacier.

You can use it to prevent an object from being deleted or overwritten for:

• a fixed amount of time

• or indefinitely. 

Object retention is handled two different ways:

1. Retention periods — fixed period of time during which an object remains locked.

2. Legal holds — remains locked until you remove the hold

S3 buckets with Object Lock can't be used as destination buckets for server access log

S3 Object Lock — Setting Object Lock on Objects

Object Locking setting can only be set via the AWS API eg (CLI, SDK) and not the AWS Console

Object Locking can be configured via AWS API (CLI, SDK) and the AWS Console

This is to avoid misconfiguration by non-technical users locking objects

This allows both technical and non-technical users to prevent object deletion or modification, ensuring compliance and data integrity

What is the primary purpose of using AWS S3 Object Lock? (To prevent the deletion of objects in a bucket)

What are the two ways to handle object retention in AWS S3 Object Lock? (1. Retention periods (a fixed period of time during which an object remains locked) 2.Legal holds (where an object remains locked until the hold is removed)

Amazon S3 Bucket URI

The S3 Bucket URI (Uniform Resource Identifier ) is a way to reference the address of S3 bucket and s3 objects.

s3://myexamplebucket/photo.jpg

You’ll see this S3 Bucket URI required to be used for specific AWS CLI commands

aws s3 cp test.txt s3://mybucket/test2.txt

In the S3 Bucket URI 's3://myexamplebucket/photo.jpg', what does 'myexamplebucket' represent? (The name of the S3 bucket)

What does an Amazon S3 Bucket URI primarily reference? (An Amazon S3 Bucket URI primarily references the address of an S3 bucket or objects within that bucket.)

AWS S3 CLI

aws s3

A high-level way to interact with S3 buckets and objects

aws s3api

A low-level way to interact with S3 buckets and objects

aws s3control

Managing s3 access points, S3 outposts buckets, S3 batch operations, storage lens.

aws s3outposts

Manage endpoints for S3 outposts

Which AWS CLI command is a high-level way to interact with S3 buckets and objects? (aws s3)

What functionalities does aws s3control offer in the context of AWS S3? (aws s3control is used for managing S3 access points, S3 Outposts buckets, S3 batch operations, and storage lens, offering advanced control over specific S3 features and configurations.)

S3 – Request Styles

When making requests by using the REST API there are two styles of request:

1. Virtual hosted-style requests — the bucket name is a subdomain on the host

2. Path-style requests — the bucket name is in the request path

Virtual hosted–Style request

DELETE /puppy.jpg HTTP/1.1

Host: examplebucket.s3.us-west-2.amazonaws.com

Date: Mon, 11 Apr 2016 12:00:00 GMT

x-amz-date: Mon, 11 Apr 2016 12:00:00 GMT

Authorization: authorization string

Path-style request

DELETE /examplebucket/puppy.jpg HTTP/1.1

Host: s3.us-west-2.amazonaws.com

Date: Mon, 11 Apr 2016 12:00:00 GMT

x-amz-date: Mon, 11 Apr 2016 12:00:00 GMT

Authorization: authorization string

S3 supports both virtual-hosted–style and path-style URL  Path-style URLs will be discontinued in the future

To force AWS CLI to use Virtual hosted-style requests, you need to globally configure the CLI

aws configure set s3.addressing_style virtual

AWS S3 CLI

S3 Storage Classes Overview

Which of the following describes a virtual hosted-style request in Amazon S3? (The bucket name is a subdomain of the host.) 

How do you configure the AWS CLI to use virtual hosted-style requests by default for Amazon S3? (aws configure set s3.addressing_style virtual) 

S3 Storage Classes Overview

AWS offers a range of S3 storage classes that trade Retrieval Time, Accessibility and Durability for Cheaper Storage

S3 Standard (default)

Fast, Available and Durable.

S3 Reduced Redundancy Storage (RRS) legacy storage class

S3 Intelligent Tiering

Uses ML to analyze object usage and determine storage class. Extra fee to analyze

S3 Express One-Zone

single-digit ms performance, special bucket type, one AZ, 50% less than Standard cost

S3 Standard-IA (Infrequent Access)

Fast, Cheaper if you access less than once a month.

Extra fee to retrieve. 50% less than Standard (reduced availability)

S3 One-Zone-IA

Fast Objects only exist in one AZ. Cheaper than Standard IA by 20% less

(Reduce durability) Data could get destroyed. Extra fee to retrieve.

S3 Glacier Instant Retrieval

For long-term cold storage. Get data instantly

S3 Glacier Flexible Retrieval

takes minutes to hours get data (Standard, Expediated, Bulk Retrieval)

S3 Glacier Deep Archive

The lowest cost storage class. Data retrieval time is 12 hours.

S3 Outposts has its own storage class

What does AWS S3 Intelligent Tiering do? (Analyzes object usage using machine learning to determine the most cost-effective storage class.)

What is the primary benefit of using AWS S3 Standard storage class? (S3 Standard offers fast access, high availability, and high durability, making it suitable for frequently accessed data.)

S3 Storage Classes — Standard

S3 Storage Standard is the default storage class when you upload to S3.

It’s designed for general purpose storage for frequently accessed data

• High Durability: 11 9’s of durability (99.999999999%)

• High Availability: 4 9’s of availability (99.99%)

• Data Redundancy: Data stored in 3 or more Availability Zones (AZs)

• Retrieval Time: within milliseconds (low latency)

• High Throughput: optimized for data that is frequently accessed and/or requires real-time access

• Scalability: easily scales to storage size and number of requests

• Use Cases: Ideal for a wide range of use cases like content distribution, big data analytics, and mobile and gaming applications, where frequent access is required.

Pricing:

• Storage per GB

• Per Requests

• No Retrieval fee

• No minimum storage duration charge

What is the durability guarantee of Amazon S3 Storage Standard? (99.999999999%) 

What are the primary use cases for S3 Storage Standard? (S3 Storage Standard is ideal for content distribution, big data analytics, and mobile and gaming applications, where frequent access is required.)

S3 Storage Classes — RRS

S3 Reduced Redundancy Storage (RRS) is a legacy storage class to store noncritical, reproducible data at lower levels of redundancy than Amazon S3’s standard storage

RRS was introduced in 2010, and at the time, it was cheaper than Standard storage.

In 2018, S3 Standard infrastructure changed, and the cost of S3 Standard storage fell well below the cost of RRS.

RSS currently provides no cost-benefit to customers for the reduced redundancy and has no place in modern storage use cases

RRS is no longer cost-effective and is not recommended for use. It may appear in the AWS Console as an option due to legacy customers

Why is RRS no longer recommended for use in modern storage use-cases? (It is more expensive than S3 Standard without offering any cost-benefit)

What was the primary goal of introducing Amazon S3 Reduced Redundancy Storage (RRS) in 2010? (To store noncritical, reproducible data at lower levels of redundancy than Amazon S3’s standard storage, offering a cost-effective solution for such data.)

S3 Storage Classes — Standard-IA

S3 Standard-IA (Infrequent Access) storage class is designed for data that is less frequently accessed but requires rapid access when needed.

• High Durability: 11 9's of durability like S3 Standard

• High Availability: 3 9’s of availability (99.9%) Slower availability compared to S3 Standard

• Data Redundancy: Data stored in 3 or more Availability Zones (AZs)

• Cost-Effective Storage: costs 50% less from Standard. As long as you don’t access a file more than once a month!

• Retrieval Time: within milliseconds (low latency)

• High Throughput: optimized for rapid access, although the data is accessed less frequently compared to S3 Standard.

• Scalability: easily scales to storage size and number of requests like S3 Standard

• Use Cases: Ideal for data that is accessed less frequently but requires quick access when needed, such as disaster recovery, backups, or long-term data stores where data is not frequently accessed.

• Pricing:

  • Storage per GB

  • Per Requests

  • Has a Retrieval fee

  • Has a minimum storage duration charge of 30 days

What is the minimum storage duration charge for S3 Standard-IA? (30 days)

What is the data redundancy level of Amazon S3 Standard-IA? (S3 Standard-IA stores data in 3 or more Availability Zones (AZs), ensuring high data redundancy.)

Change S3 storage class. 

aws s3 cp test.txt s3://cadent-bucket --storage-class STANDARD_IA 

S3 Storage Classes — Express One Zone

Amazon S3 Express One Zone delivers consistent single-digit millisecond data access for your most frequently accessed data and latency-sensitive applications

• the lowest latency cloud object storage class available

• data access speeds up to 10x faster than S3 Standard

• request costs 50% lower than than S3 Standard

• data is stored in a user selected single Availability Zone (AZ)

• data is stored in a new bucket type: an Amazon S3 Directory bucket

S3 Directory bucket supports simple real-folder structure, you are only allowed 10 by default S3 Directory buckets per account

Express One Zone applies a flat per request charge for request sizes up to 512 KB.

Which of the following best describes Amazon S3 Express One Zone's data access speed compared to S3 Standard? (Which of the following best describes Amazon S3 Express One Zone's data access speed compared to S3 Standard?)

What is the limitation on the number of S3 Directory buckets you can have per account in Amazon S3 Express One Zone?(You are allowed only 10 S3 Directory buckets per account in Amazon S3 Express One Zone.)

S3 Storage Classes — One-Zone-IA

S3 One-Zone IA (Infrequent Access) storage class is designed for data that is less frequently accessed and has additional saving at reduced availability.

• High Durability: 11 9's of durability like S3 Standard and S3 Standard IA

• Lower Availability: 99.5%. Since it's in a single AZ, it has even lower availability than Standard IA

• Cost-Effective Storage: costs 20% less than Standard IA

• Data Redundancy: Data stored in one Availability Zones (AZs) there is a risk of data loss in case of AZ disaster.

• Retrieval Time: within milliseconds (low latency)

• Use Cases: Ideal for secondary backup copies of on-premises data, or for storing data that can be recreated in the event of an AZ failure. It's also suitable for storing infrequently accessed data that is non mission-critical.

• Pricing:

  • Storage per GB

  • Per Requests

  • Has a Retrieval fee

  • Has a minimum storage duration charge of 30 days

What is the availability percentage of the S3 One-Zone-IA storage class? (99.5%)

What are ideal use cases for S3 One-Zone-IA storage class? (Ideal for secondary backup copies of on-premises data, storing data that can be recreated in the event of an AZ failure, and for storing infrequently accessed, non mission-critical data.)

S3 Glacier Storage Classes vs S3 Glacier “Vault”

S3 Glacier “Vault”

“S3” Glacier is a stand-alone service from S3 that uses vaults over bucket to store data long term.

S3 Glacier is the original vault service.

• It has vault control policies

• Most interactions occur via the AWS CLI

• Enterprises are still using S3 Glacier Vault

S3 Glacier Deep Archive is part of S3 Glacier “Vault”

S3 Glacier Storage Classes

S3 Glacier Storage classes offer similar functionality to S3 Glacier but with greater convenience and flexibility, all within s3 Buckets

This is a new class with no attachment to S3 Glacier Vault

S3 Glacier Instant

These two are using S3 Glacier Vault underneath

S3 Glacier Flexible

S3 Glacier Deep Archive

Which S3 Glacier Storage Class is directly using S3 Glacier Vault underneath? (S3 Glacier Deep Archive, S3 Glacier Flexible) 

How do S3 Glacier Storage Classes differ from the original S3 Glacier service? (S3 Glacier Storage Classes offer more flexibility and convenience, integrating directly with S3 Buckets, unlike the original S3 Glacier service that uses vaults.)

S3 Storage Classes — Glacier Instant Retrieval

S3 Glacier Instant Retrieval is a storage class designed for rarely accessed data that still needs immediate access in performance-sensitive use cases.

• High Durability: 11 9's of durability like S3 Standard

• High Availability: 3 9’s of availability (99.9%) like S3 Standard IA

• Cost-Effective Storage: 68% lower cost than Standard IA,

  • For long-lived data that is accessed once per quarter

• Retrieval Time: within milliseconds (low latency)

• Use Cases: Rarely access data that needs immediate access eg. image hosting, online file-sharing applications, medical imaging and health records, news media assets, and satellite and aerial imaging.

• Pricing:

  • Storage per GB

  • Per Requests

  • Has a Retrieval fee

  • Has a minimum storage duration charge of 90 days

Glacier Instant Retrieval is not a separate service and does not require a Vault

Which of the following is a use case for S3 Glacier Instant Retrieval? (Medical imaging and health records, Satellite and aerial imaging, Image hosting) 

What is the minimum storage duration charge for Amazon S3 Glacier Instant Retrieval? (The minimum storage duration charge for Amazon S3 Glacier Instant Retrieval is 90 days.)

S3 Storage Classes — Glacier Flexible Retrieval

S3 Glacier Flexible Retrieval (formally S3 Glacier) combines S3 and Glacier into a single set of APIs. It’s considerably faster than Glacier Vault-based storage.

There are 3 retrieval tiers: (the faster and more expensive)

Expedited Tier 1-5 mins For urgent requests. Limited to 250 MB archive size

Standard Tier 3-5 hours No archive size limit. This is the default option

Bulk Tier 5-12 hours No archive size limit, even petabytes worth of data. Bulk retrieval is free of charge (no cost per GB).

You pay per GB retrieved and number of requests This is a separate cost from just the cost of storage.

Archived objects will have an additional 40KBs of data:

• 32KB for archive index and archive metadata information

• 8KB for the name of the object

You should store fewer and larger files instead of smaller files. 40KBs on thousands of files add up.

Glacier Flexible Retrieval is not a separate service and does not require a Vault

Which retrieval tier in S3 Glacier Flexible Retrieval does not have an archive size limit and is considered the default option? (Standard Tier)

What are the three retrieval tiers available in S3 Glacier Flexible Retrieval, and what is the retrieval speed for each? (Expedited (1-5 minutes)

• Standard (3-5 hours)

• Bulk (5-12 hours)

S3 Storage Classes — Glacier Deep Archive

S3 Glacier Deep Archive combines S3 and Glacier into a single set of APIs.

It's more cost-effective than S3 Glacier Flexible but greater cost of retrieval.

There are two retrieval tiers:

Standard Tier restores within 12 hours

No archive size limit. This is the default option

There is no expedited tier for Glacier Deep Archive

Bulk Tier restores within 48 hours

No archive size limit, even petabytes worth of data.

Archived objects will have an additional 40KBs of data:

• 32KB for index and metadata information

• 8KB for the name of the object

Glacier Deep Archive is not a separate service and does not require a Vault

What is the retrieval time range for the Standard Tier in S3 Glacier Deep Archive? (12-48 hours)

Is there an expedited retrieval tier available in S3 Glacier Deep Archive? (No)

S3 Storage Classes – Intelligent-Tiering

S3 Intelligent-Tiering automatically moves objects into different storage tiers to optimize cost and performance. A small monthly fee applies for object monitoring and automation.

Key Features

Frequent Access Tier:

• Default tier; objects remain as long as they are accessed.

Infrequent Access Tier:

• Objects move here after 30 days of inactivity.

Archive Instant Access Tier:

• Objects move here after 90 days of inactivity.

Optional Archive Tiers:

• Archive Access Tier: After 90 days, access on demand.

• Deep Archive Access Tier: After 180 days, access on demand.

Important Notes

• Additional cost applies for analyzing objects over a 30-day period.

• Ideal for data with changing or unknown access patterns.

AWS CLI Command Example

aws s3api put-object \

  --bucket my-bucket \

  --key 'myfile' \

  --body 'path/to/local/file' \

  --storage-class INTELLIGENT_TIERING

What does the S3 Intelligent-Tiering storage class do? (It automatically moves objects to the most cost-effective access tier based on how frequently they are accessed.)

After how many days of no access is an object moved from the Frequent Access tier to the Infrequent Access tier in S3 Intelligent-Tiering? (An object is moved from the Frequent Access tier to the Infrequent Access tier after 30 days of no access in S3 Intelligent-Tiering.)

Which AWS S3 storage class has the highest availability guarantee? (S3 Standard)

What is the first byte latency for the 'Glacier Deep Archive' storage class? (hours)

What is the minimum storage duration charge for the S3 Glacier Deep Archive? (180 days)

What does '11 9's' refer to in the context of Amazon S3 storage classes? (It refers to the durability of the storage, meaning 99.999999999% durability, indicating a very high level of reliability where data is very unlikely to be lost.)

Which S3 storage class offers the fastest first-byte latency? (S3 Express One-Zone)

S3 Security Overview

• Bucket Policies: Define permissions for an entire S3 bucket using JSON-based access policy language.

• Access Control Lists (ACLs): Provide a legacy method to manage access permissions on individual objects and buckets.

• AWS PrivateLink for Amazon S3: Enables private network access to S3, bypassing the public internet for enhanced security.

• Cross-Origin Resource Sharing (CORS): Allows restricted resources on a web page from another domain to be requested.

• Amazon S3 Block Public Access: Offers settings to easily block public access to all your S3 resources.

• IAM Access Analyzer for S3: Analyzes resource policies to help identify and mitigate potential access risks.

• Internetwork Traffic Privacy: Ensures data privacy by encrypting data moving between AWS services and the Internet.

• Object Ownership: Manages data ownership between AWS accounts when objects are uploaded to S3 buckets.

• Access Points: Simplifies managing data access at scale for shared datasets in S3.

• Access Grants: Providing access to S3 data via a directory services e.g. Active Directory

• Versioning: Preserves, retrieves, and restores every version of every object stored in an S3 bucket.

• MFA Delete: Adds an additional layer of security by requiring MFA for the deletion of S3 objects.

• Object Tags: Provides a way to categorize storage by assigning key-value pairs to S3 objects.

• In-Transit Encryption: Protects data by encrypting it as it travels to and from S3 over the internet.

• Server-Side Encryption: Automatically encrypts data when writing it to S3 and decrypts it when downloading.

• Client-Side Encryption: Encrypts data client-side before uploading to S3 and decrypts it after downloading.

• Compliance Validation for Amazon S3: Ensures S3 services meet compliance requirements like HIPAA, GDPR, etc.

• Infrastructure Security: Protects the underlying infrastructure of the S3 service, ensuring data integrity and availability.

Which of the following AWS services enables private network access to S3, bypassing the public internet for enhanced security? (AWS PrivateLink for Amazon S3)

What is the role of Bucket Policies in Amazon S3? (Bucket Policies define permissions for an entire S3 bucket using a JSON-based access policy language, enabling administrators to manage access at the bucket level.)

Amazon S3 Block Public Access

Overview

• Block Public Access is a safety feature enabled by default to block all public access to an S3 bucket.

• Unrestricted S3 bucket access is the #1 security misconfiguration.

Key Features

• Block all public access setting prevents:

  • New Access Control Lists (ACLs)

  • Any Access Control Lists

  • New Bucket Policies or Access Points

  • Any Bucket Policies or Access Points

Important Notes

• Access Points can have independent Block Public Access settings.

Which of the following is considered the #1 security misconfiguration for Amazon S3 buckets? (Unrestricted access to S3 buckets)

Can access points have their own independent Block Public Access setting in Amazon S3? (Yes, access points can have their own independent Block Public Access setting in Amazon S3, allowing for more granular control over data access and security.)

What is the primary function of the Amazon S3 Block Public Access feature? (Block all public access to an S3 bucket by default, enhancing the security of the data stored within.) 

Amazon S3 — Access Control Lists (ACLs)

ACLs grant basic read/write permissions to other AWS accounts

• you can grant permissions only to other AWS accounts

• you cannot grant permissions to users in your account

• You cannot grant conditional permissions

• You cannot explicitly deny permissions

S3 ACLs has been traditionally used to allow other AWS accounts to upload objects to a bucket

Access Controls Lists (ACLs) is a legacy feature of S3 and there are more robust ways to provide cross-account access via bucket policies and access points.

What is the primary function of Amazon S3 Access Control Lists (ACLs)? (To grant basic read/write permissions to other AWS accounts)

Can you grant permissions to users in your own AWS account using S3 ACLs? (No)

## Create a new bucket

```sh

aws s3api create-bucket --bucket acl-example-ab-5235 --region us-east-1

```

## Turn of Block Public Access for ACLs

```sh

aws s3api put-public-access-block \

--bucket acl-example-ab-5235 \

--public-access-block-configuration "BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=true,RestrictPublicBuckets=true"

```

```sh

aws s3api get-public-access-block --bucket acl-example-ab-5235

```

## Change Bucket Ownership

```sh

aws s3api put-bucket-ownership-controls \

--bucket acl-example-ab-5235 \

--ownership-controls="Rules=[{ObjectOwnership=BucketOwnerPreferred}]"

```

## Change ACLs to allow for a user in another AWS Account

```sh

aws s3api put-bucket-acl \

--bucket acl-example-ab-5235 \

--access-control-policy file:///workspace/AWS-Examples/s3/acls/policy.json

```

## Access Bucket from other account

```sh

touch bootcamp.txt

aws s3 cp bootcamp.txt s3://acl-example-ab-5235

aws s3 ls s3://acl-example-ab-5235

```

## Cleanup

```sh

aws s3 rm s3://acl-example-ab-5235/bootcamp.txt

aws s3 rb s3://acl-example-ab-5235

{

  "Grants": [

    {

      "Grantee": {

        "DisplayName": "andrewbrown",

        "ID": "e602ac4aeb23a4d25642f95dc2fbc085279cf5b30824067afbb329d7eeb49fe5",

        "Type": "CanonicalUser"

      },

      "Permission": "FULL_CONTROL"

    }

  ],

  "Owner": {

    "DisplayName": "andrewbrown",

    "ID": "74ababf54b6810c1d34431ceee560f5de666617490e539850338964d29c30eef"

  }

}

Amazon S3 – Bucket Policies

S3 Bucket Policy

• A resource-based policy to grant an S3 bucket and bucket objects to other Principles e.g., AWS Accounts, Users, AWS services.

Example Policies

Only allow a specific role to read objects with prod object tag

{

  "Version":"2012-10-17",

  "Statement":[{

    "Principal":{

      "AWS":"arn:aws:iam::123456789012:role/ProdTeam"

    },

    "Effect":"Allow",

    "Action":[

      "s3:GetObject",

      "s3:GetObjectVersion"

    ],

    "Resource":"arn:aws:s3:::my-bucket/*",

    "Condition":{

      "StringEquals":{

        "s3:ExistingObjectTag/environment":"prod"

      }

    }

  }]

}

• Principal: The entity (AWS account, IAM user, or role) that is allowed or denied access to a resource.

• Effect: Specifies whether the statement results in an allow or an explicit deny.

• Action: List of actions that are allowed or denied.

• Resource: Specifies the object(s) the policy applies to.

• Condition: Specifies conditions for when the policy is in effect.

Restrict access to a specific IP

{

  "Version":"2012-10-17",

  "Id":"S3PolicyId1",

  "Statement":[{

    "Sid":"IPAllow",

    "Effect":"Deny",

    "Principal":"*",

    "Action":"s3:*",

    "Resource":[

      "arn:aws:s3:::my-bucket",

      "arn:aws:s3:::my-bucket/*"

    ],

    "Condition":{

      "NotIpAddress":{

        "aws:SourceIp":"192.0.2.0/24"

      }

    }

  }]

}

• Principal: * means all principals (everyone).

• Effect: Deny specifies that all actions are denied unless they match the NotIpAddress condition.

• Condition: NotIpAddress restricts access to specific IP ranges.

• Action: s3:* indicates all S3 actions are covered.

Important Terms

• resource-based policy: A policy attached directly to an AWS resource (S3 bucket).

• Effect: Can be Allow or Deny.

• Principal: The entity that is allowed or denied access.

• Action: The specific action(s) that are allowed or denied.

• Resource: The resource(s) to which the policy applies.

• Condition: Additional conditions that must be met for the policy to apply.

What is an Amazon S3 Bucket Policy primarily used for? (To grant or deny permissions to S3 bucket and objects.)

What is a resource-based policy in Amazon S3? (A policy attached directly to an AWS resource like an S3 bucket.) 

How can you restrict access to an S3 bucket to a specific IP address? (You can restrict access to a specific IP address by creating a policy statement with "Effect": "Deny")

## Create a bucket

aws s3 mb s3://bucket-policy-example-ab-5235

## Create bucket policy

aws s3api put-bucket-policy --bucket bucket-policy-example-ab-5235 --policy file://policy.json

# In the other account access the bucket

touch bootcamp.txt

aws s3 cp bootcamp.txt s3://bucket-policy-example-ab-5235

aws s3 ls s3://bucket-policy-example-ab-5235

## Cleanup

aws s3 rm s3://bucket-policy-example-ab-5235/bootcamp.txt

aws s3 rb s3://bucket-policy-example-ab-5235

{

  "Statement": [

     {

        "Effect": "Allow",

        "Principal": {

           "AWS": "arn:aws:iam::387543059434:user/andrewbrown"

        },

        "Action": [

          "s3:ListBucket",

          "s3:GetObject",

          "s3:PutObject"

        ],

        "Resource": [

          "arn:aws:s3:::bucket-policy-example-ab-5235",

          "arn:aws:s3:::bucket-policy-example-ab-5235/*"

        ]

     }

  ]

}

S3 Bucket Policies vs IAM Policies

S3 Bucket policies have overlapping functionality as an IAM policy that grants access to S3.

S3 Bucket Policies provide convenience over IAM policies granting S3 access.

S3 Bucket Policy

Provides access to a specific bucket and its objects

You can specify multiple principals to grant access

Bucket Policies can be 20 KB in size

Block Public Access is turned on by default and will DENY all anonymous access even if the bucket policy grants it (unless the feature is turned off.)

IAM Policy

Provides access to many AWS services Can provide permissions for multiple buckets in one policy

The principal, by default, is the entity the IAM policy is attached to

IAM policy sizes are limited based on the principal:

• Users 2 KB

• Groups 5 KB

• Roles 10 KB

What is the primary advantage of using an S3 Bucket Policy over an IAM Policy for granting access to S3? (S3 Bucket Policies allow specifying multiple principals.)

What is the default setting of Block Public Access in S3 Bucket Policies, and what does it do? (Block Public Access is turned on by default in S3 Bucket Policies, denying all anonymous access even if the bucket policy otherwise grants it.)

Amazon S3 — Access Grants

Amazon S3 Access Grants lets you map identities in a directory service

(IAM Identify center, Active Directory, Okta) to access datasets in s3.

a logical container for individual grants

determines which bucket data you access

The granular scope of access within a location

level of access:

• READ

• WRITE

• READWRITE

What will have access:

• IAM role

• IAM user

Bucket objects eg. mybucket/scifi/*

request just-in-time access credentials

Which of the following services allows you to map identities in a directory service to access datasets in Amazon S3? (Amazon S3 Access Grants)

What types of access levels can be defined within Amazon S3 Access Grants? (READ, WRITE, and READWRITE)

IAM Access Analyzer for S3

Access Analyzer for S3 will alert you when your S3 buckets are exposed to the Internet or other AWS Accounts

In order to use Access Analyzer for S3, you need to first create an analyzer in IAM Access Analyzer at the account level.

View buckets per region

Download a report

What is the primary function of Access Analyzer for S3? (To alert users when their S3 buckets are exposed to the Internet or other AWS accounts) 

What is one of the features provided by Access Analyzer for S3? (Ability to view buckets per region.)

Amazon S3 — Iternetwork traffic privacy

What is Internetwork traffic privacy?

Internetwork traffic privacy is about keeping data private as it travels across different networks.

AWS PrivateLink (VPC Interface Endpoints)

• Allows you to connect an Elastic Network Interface Interface (ENI) directly to other AWS Services eg. S3, EC2, Lambda

• It can connect to select Third-Party services via the AWS Marketplace.

• AWS PrivateLink can go cross-account

• Has fine-grain permissions via VPC endpoint policies

• There is a charge for using AWS PrivateLink

VPC Gateway Endpoint

• Allows you to connect a VPC directly to S3 (or DynamoDB), staying private within the internal AWS network.

• VPC Gateway Endpoint can not go cross-account

• Does not have fine-grain permissions

There is no charge to use VPC Gateway Endpoints

What distinguishes AWS PrivateLink from VPC Gateway Endpoint in terms of cross-account functionality? (AWS PrivateLink can go cross-account, while VPC Gateway Endpoint cannot)

What is the main benefit of using AWS PrivateLink for connecting to AWS services like S3 or EC2? (AWS PrivateLink provides a private connection between AWS services and your VPC, bypassing the public internet, which enhances security and reduces exposure to threats.)

Cross-Origin Resource Sharing (CORS)

Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any other origins (domain, scheme, or port) than its own from which a browser should permit loading of resources

Access is controlled via HTTP headers

Request Headers

• Origin

• Access-Control-Request-Method

• Access-Control-Request-Headers

Response Headers

• Access-Control-Allow-Origin

• Access-Control-Allow-Credentials

• Access-Control-Expose-Headers

• Access-Control-Max-Age

• Access-Control-Allow-Methods

• Access-Control-Allow-Headers

CORS restrict which websites may access data to be loaded onto its page

What is the purpose of Cross-Origin Resource Sharing (CORS)? (To enable a server to specify which origins can access its resources.)

What is the role of the "Origin" request header in CORS? (The "Origin" request header is used by the browser to inform the server about the origin (domain, scheme, or port) of the request, allowing the server to determine whether to allow or deny the request based on its CORS policy.)

Amazon S3 CORS

Amazon S3 allows you to set CORS configuration to a S3 bucket with static website hosting so different origins can perform HTTP requests from your S3 Static website.

The CORS configuration can be in either JSON or XML

• The AWS Console only access JSON.

In real-world use cases, you should not wildcard (allow all) origin since this would negate the protection that CORS is supposed to serve.

What does CORS stand for in the context of Amazon S3? (Cross-Origin Resource Sharing)

What is the purpose of CORS in the context of Amazon S3? (CORS (Cross-Origin Resource Sharing) allows different origins to perform HTTP requests from an Amazon S3 Static website, managing how resources can be requested from another domain.)

# Create Website 1

## Create a bucket

```sh

aws s3 mb s3://cors-fun-ab-36252

```

## Change block public access

```sh

aws s3api put-public-access-block \

--bucket cors-fun-ab-36252 \

--public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=false,RestrictPublicBuckets=false"

```

## Create a bucket policy

```sh

aws s3api put-bucket-policy --bucket cors-fun-ab-36252 --policy file://bucket-policy.json

```

## Turn on static website hosting

```sh

aws s3api put-bucket-website --bucket cors-fun-ab-36252 --website-configuration file://website.json

```

## Upload our index.html file and include a resource that would be cross-origin

aws s3 cp index.html s3://cors-fun-ab-36252

## View the website and see if the index.html is there.

It this for ca-central-1

http://cors-fun-ab-36252.s3-website.ca-central-1.amazonaws.com

Other regions might ue a hyphen instead

http://cors-fun-ab-36252.s3-website-ca-central-1.amazonaws.com

# Create Website 2

```sh

aws s3 mb s3://cors-fun2-ab-36252

```

## Change block public access

```sh

aws s3api put-public-access-block \

--bucket cors-fun2-ab-36252 \

--public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=false,RestrictPublicBuckets=false"

```

## Create a bucket policy

```sh

aws s3api put-bucket-policy --bucket cors-fun2-ab-36252 --policy file://bucket-policy2.json

```

## Turn on static website hosting

```sh

aws s3api put-bucket-website --bucket cors-fun2-ab-36252 --website-configuration file://website.json

```

## Upload our javascript file

aws s3 cp hello.js s3://cors-fun2-ab-36252

## Create API Gateway with mock response and then test the endpoint

curl -X POST -H "Content-Type: application/json" https://1kccnjkm43.execute-api.ca-central-1.amazonaws.com/prod/hello

## Set CORS on our bucket

aws s3api put-bucket-cors --bucket cors-fun-ab-36252 --cors-configuration file://cors.json

s3/cors/bucket-policy.json 

{

  "Version": "2012-10-17",

  "Statement": [

      {

          "Sid": "PublicReadGetObject",

          "Effect": "Allow",

          "Principal": "*",

          "Action": [

              "s3:GetObject"

          ],

          "Resource": [

              "arn:aws:s3:::cors-fun-ab-36252/*"

          ]

      }

  ]

}

s3/cors/bucket-policy2.json 

{

  "Version": "2012-10-17",

  "Statement": [

      {

          "Sid": "PublicReadGetObject",

          "Effect": "Allow",

          "Principal": "*",

          "Action": [

              "s3:GetObject"

          ],

          "Resource": [

              "arn:aws:s3:::cors-fun2-ab-36252/*"

          ]

      }

  ]

}

s3/cors/cors.json 

{

  "CORSRules": [

    {

      "AllowedOrigins": ["https://1kccnjkm43.execute-api.ca-central-1.amazonaws.com"],

      "AllowedHeaders": ["*"],

      "AllowedMethods": ["PUT", "POST", "DELETE"],

      "MaxAgeSeconds": 3000,

      "ExposeHeaders": ["x-amz-server-side-encryption"]

    }

  ]

}

s3/cors/hello.js

console.log('hello world')

s3/cors/index.html

<!DOCTYPE html>

<html lang="en">

  <head>

    <meta charset="UTF-8">

    <meta name="viewport" content="width=device-width, initial-scale=1.0">

    <title>My Website!!!!</title>

    <link rel="preconnect" href="https://fonts.googleapis.com">

    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

    <link href="https://fonts.googleapis.com/css2?family=Rubik+Bubbles&display=swap" rel="stylesheet">

    <style>

      * {

        font-family: 'Rubik Bubbles'

      }

    </style>

  </head>

  <body>

    <main>

        <h1>Welcome to My Website</h1>  

        <p>What do you think of my amazing Website!</p>

    </main>

    <script type="text/javascript">

      const xhr = new XMLHttpRequest();

      xhr.open("POST", "https://1kccnjkm43.execute-api.ca-central-1.amazonaws.com/prod/hello", true);

      // Send the proper header information along with the request

      xhr.setRequestHeader("Content-Type", "application/json");

      xhr.onreadystatechange = () => {

        if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {

          const results = JSON.parse(xhr.responseText);

          console.log('results',results)

        }

      };

      xhr.send();

    </script>

  </body>

</html>

s3/cors/website.json 

{

  "IndexDocument": {

      "Suffix": "index.html"

  },

  "ErrorDocument": {

      "Key": "error.html"

  }

}

S3 Encryption Overview

Encryption In Transit

When data is encrypted by the sender and then decrypted the receiver.

Encryption-At-Rest

Client-Side Encryption (CSE)

when data is encrypted by the client and then sent to the server

The client has the key, the server will serve the encrypted file since it does not have the key to decrypt when data is requested

Server-Side Encryption (SSE)

when data is encrypted by the server

The server has the key to decrypt when data is requested

What does Encryption in Transit imply in the context of data transfer? (Data is encrypted by the sender and decrypted by the receiver.) 

Who holds the encryption key in Client-Side Encryption (CSE)? (The client holds the encryption key. This means the data is encrypted on the client's side before being sent to the server, and only the client can decrypt it.)

S3 — Encryption In Transit

Encryption In-Transit

Data that is secure when moving between locations Algorithms: TLS, SSL

This encryption ensures that data remains confidential and cannot be intercepted or viewed by unauthorized parties while in transit.

Data will be encrypted senders-side

Data will be decrypted server-side

Transport Layer Security (TLS)

An encryption protocol for data integrity between two or more communicating computer application. TLS 1.0, 1.1 are deprecated. TLS 1.2 and TLS 1.3 is the current best practice

Secure Sockets Layers (SSL)

An encryption protocol for data integrity between two or more communicating computer application SSL 1.0, 2.0 and 3.0 are deprecated

What is the primary purpose of encryption in transit? (To ensure data remains confidential and cannot be intercepted or viewed by unauthorized parties) 

What ensures data remains confidential and cannot be intercepted or viewed by unauthorized parties while in transit? (Encryption in transit, specifically using algorithms like TLS and SSL, ensures data remains confidential and cannot be intercepted or viewed by unauthorized parties while in transit.)

Are older versions of SSL considered secure and recommended for use? (No, older versions of SSL (1.0, 2.0, and 3.0) are deprecated and not recommended for use due to security vulnerabilities.)

S3 — Server-Side Encryption

Server-Side Encryption (SSE) is enabled by default for all new S3 objects.

SSE-S3

Amazon S3 manages the keys, encrypting objects using AES-256 (Cipher Block Chaining – CBC) algorithm

SSE-KMS

AWS Key Management Service (KMS) managers encryption keys. You can choose AWS-managed keys or manage customer master keys (CMKs) yourself through KMS.

SSE-C   

You provide your own encryption keys, and Amazon S3 handles encryption and decryption using these customer-provided keys. You are responsible for managing the keys.

DSSE-KMS (Dual-layer Encryption)

In dual-layer encryption, data is encrypted client-side before being uploaded to S3, and then server-side encryption (SSE) is applied within S3. This is not a specific AWS service but a strategy some users may adopt.

Server-side encryption only encrypts the contents of an object, not its metadata

Which server-side encryption option in Amazon S3 uses AWS Key Management Service (KMS) for managing the encryption keys? (SSE-KMS)

Which encryption algorithm is utilized by Amazon S3 when implementing server-side encryption with SSE-S3? (Amazon S3 uses the AES-GCM (256-bit) encryption algorithm when implementing server-side encryption with SSE-S3, where Amazon manages the encryption keys.)

Amazon S3 – SSE-S3

What is SSE-S3?

• Amazon manages all encryption for objects stored in S3.

• Each object is encrypted with a unique key.

• Envelope encryption is used.

• Keys are rotated automatically by Amazon.

• By default, SSE-S3 is applied to all objects unless specified otherwise.

• There are no additional charges for using SSE-S3.

• Uses AES-256-bit Advanced Encryption Standard (AES-GCM) for securing data.

Explicit Configuration:

• You can explicitly set SSE-S3 when uploading objects:

aws s3api put-object \

  --bucket mybucket \

  --key myfile \

  --server-side-encryption AES256 \

  --body myfile.txt 

Default Behavior:

• If no encryption configuration is specified, SSE-S3 is automatically applied:

aws s3api put-object \

  --bucket mybucket \

  --key myfile \

  --body myfile.txt

Clarification About Bucket Keys:

• Bucket Keys improve performance and reduce costs by caching encryption keys.
  Note: This applies to SSE-KMS, not SSE-S3.

What does SSE-S3 stand for, and who manages the encryption in this context? (Server-Side Encryption-S3, where Amazon manages all the encryption)

How does Amazon S3 handle key rotation for SSE-S3 encryption? (Amazon S3 automatically rotates the key regularly when using SSE-S3 encryption.)

Amazon S3 - SSE-KMS

SSE-KMS is when you use a KMS key managed by AWS.

• You first create a KMS managed key

• You choose the KMS key to encrypt your object

• KMS can automatically rotate keys

• KMS key policy controls who can decrypt using the key

• KMS can help meet regulatory compliance

• KMS keys have their own additional costs

• AWS KMS keys must be in the same Region as the bucket

• AWS KMS keys can be multi-region, allowing the same key to be used in different regions, not limited to the bucket’s region.

• To upload with KMS you need kms:GenerateDataKey

• To download with KMS you need kms:Decrypt

Bucket Key can be set for SSE-KMS for improved performance

Using a KMS with aws s3api

aws s3api put-object \

--bucket mybucket \

--key example.txt \

--body example.txt \

--server-side-encryption "aws:km" \

--ssekms-key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Using a KMS key with aws s3 

aws s3 cp example.txt s3://mybucket/example.txt \

--sse aws:km \

--sse-kms-key-id 1234abcd-12ab-34cd-56ef-1234567890ab

What is required to upload an object with SSE-KMS encryption in Amazon S3? (kms:GenerateDataKey permission)

What is a key benefit of using AWS KMS for encryption key management in S3? (The ability to automatically rotate encryption keys, aiding in meeting regulatory compliance.)

Can AWS KMS keys be used across multiple regions for Amazon S3, and if so, how? (Yes, AWS KMS keys can be multi-region, allowing the same key to be used in different regions, which is not limited to the bucket's region.)

Amazon S3 – SSE-C

SSE-C is when you provide your own encryption key that Amazon S3 then uses to apply AES-256 encryption to your data.

• You need to provide the encryption key every time you retrieve objects

  • The encryption key you upload is removed from Amazon S3 memory after each request

• There is no additional charge to use SSE-C

• Amazon S3 will store a randomly salted Hash-based Message Authentication Code (HMAC) of your encryption key to validate future requests

• Presigned URLs support SSE-C

With bucket versioning, different object versions can be encrypted with different keys

you manage encryption keys on the client side, you manage any additional safeguards, such as key rotation, on the client side.

BASE64_ENCODED_KEY=$(openssl rand -base64 32)

aws s3api put-object \

--bucket mybucket \

--key myfile \

--body file://myfile.txt \

--sse-customer-algorithm AES256 \

--sse-customer-key $BASE64_ENCODED_KEY \

--sse-customer-key-md5 `echo -m $BASE64_ENCODED_KEY | base64 --decode | md5sum | awk '{print $1}' | base64`

What is required every time you retrieve an object using SSE-C in Amazon S3? (The same encryption key used for uploading)

What does Amazon S3 do with your encryption key after processing your SSE-C request? (Amazon S3 removes the encryption key from memory after each request and stores a salted HMAC of the key to validate future requests.)

Amazon S3 – DSSE-KMS

DSSE (Dual-layer server-side encryption) KMS. It’s SSE-KMS with the inclusion of client-side encryption.

It would be more accurate to call it CSE-KMS

• With DSSE-KMS, data is encrypted twice

• The key used for client-side encryption comes from KMS

• There are additional charges for DSSE and KMS keys

aws s3api put-object \

--bucket mybucket \

--key myfile \

--server-side-encryption aws:kms:dsse \

--ssekms-key-id "1234abcd-12ab-34cd-56ef-1234567890ab" \

--body filepath

Encrypt

• client-side requests AWS KMS to generate a data encryption key (DEK) using the CMK.

• KMS sends two versions of the DEK to you: a plaintext version and an encrypted version

• You use the plaintext DEK to encrypt your data locally and then discard it from memory.

• encrypted version of the DEK is stored alongside the encrypted data in Amazon s3

Decrypt

• you retrieve the encrypted data and the associated encrypted DEK

• You send the encrypted DEK to AWS KMS, which decrypts it using the corresponding CMK and returns the plaintext DEK.

• use this plaintext DEK to decrypt the data locally and then discard the DEK from memory

What is the primary purpose of DSSE-KMS in Amazon S3? (To provide an additional layer of encryption by combining server-side and client-side encryption) 

How is a data encryption key (DEK) used in the DSSE-KMS encryption process? (In the DSSE-KMS encryption process, AWS KMS generates a DEK, which is sent to the client in two forms: plaintext and encrypted. The client uses the plaintext DEK to encrypt data locally before discarding it and stores the encrypted DEK alongside the data in Amazon S3.) 

What is DSSE-KMS in the context of Amazon S3? (DSSE-KMS stands for Dual-layer server-side encryption with KMS, where data is encrypted twice - once on the client side using a key from KMS and again on the server side, enhancing data security in Amazon S3.)

## Create a bucket

aws s3 mb s3://encryption-fun-ab-135

### Create a file and Put Object with encrpytion SS3-S3

echo "Hello World" > hello.txt

aws s3 cp hello.txt  s3://encryption-fun-ab-135

### Put Object with encryption of SS3-KMS

aws s3api put-object \

--bucket encryption-fun-ab-135 \

--key hello.txt \

--body hello.txt \

--server-side-encryption "aws:kms" \

--ssekms-key-id "a1bb2b48-ce90-49ff-bd06-f23705bcc0d8"

### Put Object with SSE-C [Failed Attempt]

export BASE64_ENCODED_KEY=$(openssl rand -base64 32)

echo  $BASE64_ENCODED_KEY

export MD5_VALUE=$(echo $BASE64_ENCODED_KEY | md5sum | awk '{print $1}' | base64 -w0)

echo  $MD5_VALUE

aws s3api put-object \

--bucket encryption-fun-ab-135 \

--key hello.txt \

--body hello.txt \

--sse-customer-algorithm AES256 \

--sse-customer-key $BASE64_ENCODED_KEY \

#--sse-customer-key-md5 $MD5_VALUE

An error occurred (InvalidArgument) when calling the PutObject operation: The calculated MD5 hash of the key did not match the hash that was provided.

### Put Object with SSE-C via aws s3

https://catalog.us-east-1.prod.workshops.aws/workshops/aad9ff1e-b607-45bc-893f-121ea5224f24/en-US/s3/serverside/ssec

openssl rand -out ssec.key 32

aws s3 cp hello.txt s3://encryption-fun-ab-135/hello.txt \

--sse-c AES256 \

--sse-c-key fileb://ssec.key

aws s3 cp s3://encryption-fun-ab-135/hello.txt hello.txt --sse-c AES256 --sse-c-key fileb://ssec.key

s3/encryption/hello.txt 

Hello World 

s3/encryption/ssec.key 

S3 Bucket Key

When you use SSE-KMS, an individual data key is used on every object request In this case, S3 has to call AWS KMS every time a request is made. KMS charges on the number of requests and so this charge can add up

S3 Bucket key lets you generate a short-lived bucket-level key from AWS Key that is temporarily stored in S3

• This will reduce request costs by up to 99%

• This will decrease request traffic and improve overall performance

• A unique bucket-level key is generated for each requester 

• You can enable Bucket key at the bucket level to be applied to all new objects

• You can enable Bucket key at the object level for only specific objects

• S3 Bucket key can be enabled for SSE-S3 and SSE-KMS

What is the purpose of using an S3 Bucket Key in AWS? (To reduce request costs by up to 99%) 

How does the S3 Bucket Key reduce the number of calls to AWS KMS? (The S3 Bucket Key allows S3 to use a short-lived bucket-level key from AWS KMS, which is temporarily stored in S3, thus reducing the number of calls to AWS KMS for each object request.)

S3 — Client-Side Encryption

Client-Side Encryption is when you encrypt your own files before uploading them to S3

This provides a guarantee that AWS and no third-party can decrypt your data.

Various AWS SDK’s have built-in code to make it easy to encrypt your data

Ruby SDK you can supply an encryption key to the S3 Client, and it will automatically encrypt and decrypt server side.

Supplying no key will result in the cipher text

What does Client-Side Encryption in AWS S3 refer to? (Encrypting your own files before uploading them to S3) 

Why is Client-Side Encryption important for data stored in AWS S3? (It provides a guarantee that only the data owner can decrypt and access the content, ensuring maximum privacy and security against unauthorized access, including from AWS or any third parties.)

What does data consistency ensure when data is stored in multiple locations? (The data matches exactly across all locations.)

What is the characteristic of strongly consistent data in data storage systems?(Strongly consistent data is data where every request returns the most recent version, ensuring that the user never receives outdated information.)

S3 – Object Replication Overview

Amazon S3 Object Replication is when you make (copies) of objects into other buckets

• Data Redundancy and Durability: Enhances data protection by storing copies in different locations.

• Compliance and Data Residency: Meets legal and regulatory data storage requirements in specific regions.

• Improved Accessibility and Latency: Reduces latency by replicating data closer to end-users.

• Operational Flexibility: Separates production, backup, and development data sets for various operational needs.

• Efficient Data Processing: Facilitates parallel data processing in regions closer to AWS resources.

• Disaster Recovery and Business Continuity: Ensures business continuity with backup copies in separate locations.

• Optimized Costs: Costs can be reduced by replicating to regions with lower storage pricing.

• Cross-Account Replication: Allows secure data sharing between different AWS accounts.

• Versioning and Change Tracking: Maintains object versions in different buckets for easy rollback and tracking.

• Automated Backups and Archiving: Simplifies and updates backup and archiving processes automatically.

What is a primary benefit of Amazon S3 Object Replication in terms of data accessibility? (Reduces latency by replicating data closer to end-users.)

What is the significance of cross-account replication in Amazon S3 Object Replication? (For secure data sharing between different AWS accounts, enhancing collaboration and data management.)

How does Amazon S3 Object Replication assist in adhering to compliance and data residency requirements? (It aids by replicating and storing data in specific regions to meet legal, regulatory, and compliance requirements regarding data residency.)

S3 Versioning

S3 Versioning allows you to store multiple versions of S3 objects.

With versioning, you can recover more easily from unintended user actions and application failures

Versioning-enabled buckets can help you recover objects from accidental deletion or overwrite.

• Store all versions of an object in S3 at the same object key address

• By default, S3 Versioning is disabled on buckets, and you must explicitly enable it

• Once enabled, it cannot be disabled, only suspended on the bucket

• Fully integrates with S3 Lifecycle rules

• MFA Delete feature provides extra protection against deletion of your data

Buckets can be in three states:

1. Unversioned (default)

2. Versioned

3. Versioned Suspended

What does S3 Versioning allow you to do? (Store multiple versions of S3 objects)

What must be done to activate versioning on an S3 bucket? (Versioning is disabled by default on S3 buckets and must be explicitly enabled by the user. Once enabled, it cannot be disabled but only suspended)

What are the three possible states of an S3 bucket in terms of versioning? (1) Unversioned (default), 2) Versioned, and 3) Versioned Suspended.)

Introduction to S3 Transfer Acceleration

S3 Transfer Acceleration is a bucket-level feature that provides fast and secure transfer of files over long distances between your end users and an S3 bucket.

Utilizes CloudFront’s distributed Edge Locations to quickly enter the Amazon Global Network

Instead of uploading to your bucket, users use a distinct endpoint to route to an edge location

• https://s3-accelerate.amazonaws.com

• https://s3-accelerate.dualstack.amazonaws.com

• only supported on virtual-hosted style requests

• Buckets cannot contain periods and must be DNS-compliant

• It can take 20 minutes after Transfer Acceleration is enabled

What is the primary function of S3 Transfer Acceleration? (To provide fast and secure file transfers over long distances)

What AWS service does S3 Transfer Acceleration utilize to accelerate file uploads? (Amazon CloudFront)

S3 – Presigned URLs