S3 Flashcards
What is Amazon S3?
- Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance.
- The file stored in S3 is referred to as objects.
- It is also seen as a database that stores objects in key-value pairs. The object ID is the key, and the object is the value.
- The buckets are defined at the regional level
How Amazon S 3 security is handled
- IAM policy- which A PI calls should be allowed for a specific user from IAM
- Resource based: Bucket Policies, Object Access Control List, Bucket Access Control List
What are the key points of hosting a website on Amazon S3?
- The website must be static website and it should be accessible on the Internet
- the bucket should allow public reads in order for external users to access it’s content.
can you version Amazon S3 files
Yes, It can be enabled at the bucket level. same key can be used to access the latest version of the object.
Suspending versions does not delete the previous versions.
How to enable S3 replication?
You must enable versioning in the source and destination buckets to enable the application. There are two types of applications:
- cross-region replication (CRR)
- same region application (SRR)
- The buckets can be in different accounts.
- Copy is asynchronous.
- Must give proper IAM permissions to S3
- After you enable the replication, only new objects will be replicated. If you need to replicate, the existing objects use S3 batch replication.
- for the delete operation, you can replicate a marker from source to target (optional setting). Deletion with version ID is not replicated.
Use case: Compliance, lower latency access, replication across accounts.
How many S3 storage classes are there?
- S3 standard - General Purpose
- S3 standard - infrequent access (IA)
- S3 1 zone infrequent access
- S3 Glacier Instant Retrieval
- S3 Glacier Flexible Retrieval
- S3 Glacier deep archive
- S3 intelligent tiering
Objects can move between classes manually or using S3 Lifecycle configurations.
what is S3 standard storage class?
It is used for frequently accessed data. It has low latency and high throughput. It can sustain two concurrent facility failures.
what is S3 infrequent access?
Use for the data that is less frequently accessed but requires rapid access when needed. It is less expensive compared to the S3 standard.
there are two infrequent options:
- amazon S 3 standard infrequent access. it is used for disaster recovery and backup N
- S3 one zone infrequent access is limited to a single AZ, and you lose the data if AZ is destroyed. It is used for storing secondary back copies of on-prem data or data you can recreate.
What is Amazon S3 glacier storage classes?
It is low cost objective storage meant for archiving and backups. you pay for storage and object retrieval. there are three subclasses in glacier storage:
- Amazon S3 glacier Instant Retrieval: It offers millisecond retrieval and it is great for data accessed once a quarter. the minimum storage duration is 90 days
- Amazon s3 glacier flexible retrieval: the expedited retrieval is between one to five minutes, the standard retrieval is between 3 to 5 hours. For bulk the retrieval is in between 5 to 12 hours - it’s free. The minimum storage duration is 90 days.
- Amazon S3 Glacier Deep Archive- for long term storage: the standard retrieval is is in 12 hours and the bulk is in 48 hours. minimum storage duration is of 180 days.
What is S3 intelligent tiering?
Amazon S3 Intelligent-Tiering is the only cloud storage class that delivers automatic storage cost savings when data access patterns change without performance impact or operational overhead.
In which order objects can move from one tier to another?
you can transition objects between storage classes as shown in the diagram. The moment of objects can be done automatically by using lifecycle rules.
what is Amazon S3 lifecycle rules?
An S3 Lifecycle configuration is a set of rules that define actions that Amazon S3 applies to a group of objects. There are two types of actions:
Transition actions – These actions define when objects transition to another storage class. For example, you might choose to transition objects to the S3 Standard-IA storage class 30 days after creating them, or archive objects to the S3 Glacier Flexible Retrieval storage class one year after creating them. For more information, see Using Amazon S3 storage classes.
There are costs associated with lifecycle transition requests. For pricing information, see Amazon S3 pricing.
Expiration actions – These actions define when objects expire. Amazon S3 deletes expired objects on your behalf.
Lifecycle expiration costs depend on when you choose to expire objects. For more information, see Expiring objects.
Is there a zero-day life cycle policy?
If you set a storage class equal to 0 days, information will be immediately sent to S3 Glacier. It is of use when information is rarely accessed in everyday life, but its storage life is limited.
Though it might seem that uploading data to S3 first and going with it to Glacier afterward might be more expensive, AWS has ensured that this exact scenario leads to no more expenses than direct Glacier upload.
What is requester pays?
In general, bucket owners pay for all Amazon S3 storage and data transfer costs that are associated with their bucket. However, you can configure a bucket to be a Requester Pays bucket. With Requester Pays buckets, the requester instead of the bucket owner pays the cost of the request and the data download from the bucket. The bucket owner always pays the cost of storing data.
The requestor cannot be anonymous and must be authenticated in AWS
What is S3 event Notification?
You can use the Amazon S3 Event Notifications feature to receive notifications when certain events happen in your S3 bucket. To enable notifications, add a notification configuration that identifies the events that you want Amazon S3 to publish.
The events can be objects removed, replicated, etc. The events can be filtered based on the object names.
The events are sent to SNS, SQS lambda functions, and event bridge.
Even bridge can call over 18 AWS services to handle the event.
what is S 3 multipart upload?
Multipart upload allows you to upload a single object as a set of parts. Each part is a contiguous portion of the object’s data. You can upload these object parts independently and in any order. If transmission of any part fails, you can retransmit that part without affecting other parts. After all parts of your object are uploaded, Amazon S3 assembles these parts and creates the object. it is recommended for files that is greater than 100 MB. It must be used for files greater than 5GB.
What is S3 Transfer Acceleration?
Amazon S3 Transfer Acceleration can speed up content transfers to and from Amazon S3 by as much as 50-500% for long-distance transfer of larger objects. Customers who have either web or mobile applications with widespread users or applications hosted far away from their S3 bucket can experience long and variable upload and download speeds over the Internet. S3 Transfer Acceleration (S3TA) reduces the variability in Internet routing, congestion and speeds that can affect transfers, and logically shortens the distance to S3 for remote applications. S3TA improves transfer performance by routing traffic through Amazon CloudFront’s globally distributed Edge Locations and over AWS backbone networks, and by using network protocol optimizations.
What is s3 byte range fetches?
Using the Range HTTP header in a GET Object request, you can fetch a byte-range from an object, transferring only the specified portion. You can use concurrent connections to Amazon S3 to fetch different byte ranges from within the same object. This helps you achieve higher aggregate throughput versus a single whole-object request. Fetching smaller ranges of a large object also allows your application to improve retry times when requests are interrupted. For more information, see Getting Objects.
Typical sizes for byte-range requests are 8 MB or 16 MB.
This can also help in accessing the header part of the file to gather the high level information about it.
What is S3 select?
S3 Select is a feature of S3 that lets you specify targeted portions of an S3 object to retrieve and return to you rather than returning the entire contents of the object. You can use basic SQL expressions to select certain columns and filter for particular records in your structured file.
It makes object information retrieval 400% faster and it’s 80% cheaper
What is S3 batch operations?
S3 Batch Operations is a managed solution for performing storage actions like copying and tagging objects at scale, whether for one-time tasks or for recurring, batch workloads. S3 Batch Operations can perform actions across billions of objects and petabytes of data with a single request. The use cases are:
- copy objects between S3 buckets as a batch operation.
- something that can come up in exam, is to encrypt all the un-encrypted objects in your S3 buckets.
- Modify ACLs, or tags.
- Restore many objects at a time from S3 Glacier.
- Invoke a Lambda function
Perform whatever custom action you want on every object from your S3 Batch Operation. So, the idea is that you can do whatever operation you want on the list of objects.
What is S3 SSE-S3 Encryption?
When you use server-side encryption with Amazon S3 managed keys (SSE-S3), each object is encrypted with a unique key. As an additional safeguard, it encrypts the key itself with a root key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256) GCM, to encrypt your data.
What is Amazon S3 SSE - KMS encryption?
The encryption is done by using a key managed by AWS KMS. With KMS, you get the advantage of user control audit key usage using cloud trail. The object is encrypted on the server side.
If you are using SSE KMS, you may be impacted by KMS limit. When you upload object, it calls GenerateDataKey KMS API. when you download it calls decrypt KMS API. Every call is counted toward KMS quota per second (5500, 10000, 30000 req/s based on region)
What is Amazon S3 client-side encryption?
Client-side encryption is the act of encrypting your data locally to ensure its security as it passes to the Amazon S3 service. The Amazon S3 service receives your encrypted data; it does not play a role in encrypting or decrypting it.
How to enforce S3 Encryption?
One way to enforce encryption is to use a bucket policy. The bucket policy will refuse any PUT API call That does not have the specified encryption header.
Another way is to use default encryption option in S3
