AWS IAM and S3 Flashcards
What is IAM?
Identity Access Management:
- Core service in AWS that helps you control access to RESOURCES (S3, lambda, etc)
- The users perform ACTIONS to resources (create a bucket in S3)
- Authorizations to make ACTIONS depends on POLICIES
is IAM universal?
Yes, it is not regional
What is the root account?
The account created when you first set up your AWS account.
In an organization, the root account should be used for billing only, we shouldn’t deploy anything here
explain new users in relation with IAM?
- when they are created they have no access
- They are assigned a Access key ID and a Secret Access key to be able to login throw API calls and the command line.
- You could generate a “signed URL” to be able to access the console with the Access Key ID and the Secret Access Key.
S3 tips for exam? (storage, bucket namespace, object based type, restriction, MFA, HTTP code, etc)
BUCKET NAMESPACE
- S3 bucket name is globally unique, and the namespace is shared by all AWS accounts. This means that after a bucket is created, the name of that bucket cannot be used by another AWS account in any AWS Region until the bucket is deleted.
OBJECT BASED TYPE
- S3 is “object-based”. That means it has these attributes
- Key (name)
- Value (the data of the file)
- Version ID
- Metadata (data about data you are storing)
STORAGE
- Files can be from 0bytes to 500 terabytes (0B - 500TB)
- Unlimited storage
- Files are stored in buckets
RESTRICTIONS
- Not suitable to install a OS on
HTTP CODE
- Successful updates will generate an HTTP 200 status code
MFA
- you can turn on MFA delete
S3: how to restrict Bucket access?
- Bucket Policy: applies to the whole bucket
- Object Policy: Applies to individual files
- IAM Policies to Users&Groups: applies to users and groups
Types of S3. Which ones are more expensive
- S3 Standard
- S3 Intelligent Tier: Optimize cost by automatically moving data to the most effective Access tier (good if you don’t have thousands of files).
- S3 Infrequently Access (IA): Data that is access less frequently but needs to be access fast.
- S3 One Zone IA: For where you want the infrequently access feature but without the multiple availability zones.
- S3 Glacier: secure, durable, low-cost, storage class for data archiving
- S3 Glacier Deep Archive: Even lower S3 Glacier, where an access time of 12 hours is accepted
Which are the S3 types that are more expensive and more cheap?
Sorted by price (most expensive to less):
S3 Standard
S3 - IA (Infrequently Access)
S3 Intelligent Tiering
S3 One zone - IA (Infrequently Access)
S3 Glacier
S3 Glacier Deeper Archive
You try to avoid S3 Standard, using S3 Intelligent Tiering unless you have thousands and thousands of files (it charges you for thousands of files a commission for automation).
If you don’t have to worry about redundancy you should go with S3 One Zone IA but bear in mind that if that zone fails, you lose your data.
Can S3 versioning be disable?
After enabling versioning on a bucket, it cannot be disabled. Versioning can only be suspended after it has been enabled. Things to note: Suspending versioning stops any new versions of the objects from being created.
What are the S3 types of encryptions?
ENCRYPTION IN TRANSIT (SSL/TSL by HTTPS)
SERVER SIDE ENCRYPTION
- Key S3 (SSE S3)
- AWS Key Management Service (SSE KMS)
- Server Side Encryption With customer provided keys
Encrypt the object your self and then uploaded yourself
SSE = Server Side Encryption
When you delete a file it deletes all of their versions? And what happen when you modify the permission of the file (make it public)?
No, you have to go manually and delete all versions of that file.
Same for making a file public. It makes public the last version only. If you want previous versions to be public, you have to do it manually.
What can you do with lifecycle of S3?
- Delete old version after X amount of days
- Change the storage tier (type) of S3 (like from default to IA after some days of not using it)
You create rules for this type of things
What is S3 Object Lock?
Store an object (file) using the model “write once, read many (WORM)”.
It can help to avoid deleting or modifying for X amount of time or indefinitely.
You can set it individually or for a bucket
What are the modes of S3 Object Lock?
- Governance mode: just users with the permissions can edit or delete
- compliance mode: no user can edit or delete
What is S3 Glacier Vault Lock?
Specify controls such us WORM in a Vault lock policy and lock policy for future edits. Once lock, the policy can not be changed.
