S3 - Simple Storage Service Flashcards
1
Q
What is S3?
A
Amazon Simple Storage Service is an object storage service that offers industry-leading scalability, data availability, security, and performance
2
Q
Where are objects stored in S3?
A
in buckets
3
Q
What is globally unique on a bucket?
A
the name
4
Q
How are buckets scoped?
A
regionally
5
Q
What is the number of characters allowed in bucket’s name?
A
3-63
6
Q
What can not contain a bucket’s name?
A
no uppercase nor underscore
7
Q
How must start a bucket’s name?
A
lowercase or number
8
Q
What is the bucket object key?
A
the full path, starting after the bucket name
9
Q
What is composed of the key of a bucket object?
A
prefix + object name
10
Q
There are directories within buckets?
A
There’s no concept of “directories” within buckets
(although the UI will trick you to think otherwise)
Just keys with very long names that contain slashes (“/”)
11
Q
What is the max object size in S3?
A
5TB
12
Q
What is the max object size you can upload to S3?
A
5 GB
13
Q
What you need to do to upload an object greater than 5GB to S3?
A
use multi-part upload
14
Q
What contains an S3 object?
A
Key Version ID Value (Object itself) Metadata Subresources Access Control Information
15
Q
What is useful for S3 object tags?
A
useful for security / lifecycle
16
Q
How many S3 object tags can you use?
A
up to 10
17
Q
Can you enable versioning on an S3 object?
A
no, it is at bucket level
18
Q
How can you increment an S3 object version?
A
uploading an object with the same key
19
Q
What is the version number of a file that was not versioned prior to when versioning is enabled?
A
null
20
Q
What happens to previous versions when versioning is disabled?
A
nothing, they are not deleted
21
Q
Which are the 4 methods of encrypting objects in S3?
A
SSE-S3
SSE-KMS
SSE-C
Client Side Encryption
22
Q
What is about SSE-S3 encryption method in S3?
A
encrypts S3 objects using keys handled & managed by AWS
23
Q
What is about SSE-KMS encryption method in S3?
A
leverage AWS Key Management Service to manage encryption keys
24
Q
What is about SSE-C encryption method in S3?
A
when you want to manage your own encryption keys
25
What is about Client Side Encryption method in S3?
Customer fully manages the keys and encryption cycle
26
What encryption type is used by SSE-S3 encryption method?
AES-256
27
What you must set to use S3 SSE-S3 encryption method?
Must set header: “x-amz-server-side-encryption": "AES256"
28
What is used by SSE-KMS S3 encryption method?
A Customer Master Key (CMK)
29
What you must set to use S3 SSE-KMS encryption method?
Must set header: “x-amz-server-side-encryption": ”aws:kms"
30
What means SSE on S3 encryption methods?
Server Side Encryption
31
What you must set to use S3 SSE-C encryption method?
You must provide the key via HTTPS only
32
What you must do to use Client Side encryption method?
You must encrypt and decrypt the data by yourself before sending it or receiving it using a client library such as the Amazon S3 Encryption Client
33
What endpoints are exposed by S3?
HTTP and HTTPS (recomended)
34
What are the 2 base groups for S3 security?
User and Resource based
35
What is the User Based security on S3?
IAM policies - which API calls should be allowed for a specific user from IAM console
36
What are the Resource Based security on S3?
* Bucket Policies - bucket wide rules from the S3 console - allows cross account
* Object Access Control List (ACL) – finer grain
* Bucket Access Control List (ACL) – less common
37
How are S3 Bucket policies written?
JSON
38
What you must define on a S3 Bucket policy?
- Resources
- Actions
- Effect
- Principal
39
What means the actions in a S3 Bucket policy?
Set of API to Allow or Deny (s3:GetObject)
40
What means a resource in a S3 Bucket policy?
buckets and objects
41
What means an effect in a S3 Bucket policy?
Allow / Deny
42
What means a principal in a S3 Bucket policy?
The account or user to apply the policy to
43
How can you grant access to another account to your bucket?
Using a Bucket Policy
44
How can you grant public access to your bucket?
Using a Bucket Policy
45
What can you use to block any permission allowed over your bucket?
Use Bucket settings for Block Public Access
46
At what level does work Block Public Access setting?
At bucket and account level
47
How can you access private S3 instances without internet?
S3 supports VPC endpoints
48
Where can you store S3 access logs?
In another S3 bucket
49
Where can be logged S3 API calls?
CloudTrail
50
What can you use in order to prevent the deletion of any versioned S3 objects?
Use MFA Delete in your bucket, versioning must be enabled
51
How can you share an S3 object with an external user?
Pre-Signed URLs (valid only for a limited time)
52
Where can you host a static website and make it accessible on the www?
S3
53
What is reflected in the S3 URL of a static website hosted there?
bucket name and region
54
What if you get a 403 (Forbidden) error from a static web site deployed on S3?
make sure the bucket policy allows public reads
55
How to configure your bucket to allow cross-origin requests?
create a CORS configuration, which is an XML document with rules that identify the origins that you will allow to access your bucket, the operations (HTTP methods) that will support for each origin, and other operation-specific information.
you can also allow all origins using *
56
How is in S3 Read after write consistency for PUTS of new objects?
As soon as a new object is written, we can retrieve it
ex: (PUT 200 => GET 200)
except if we did a GET before to see if the object existed ex: (GET 404 => PUT 200 => GET 404) – eventually consistent
57
How is in S3 Read after updating an object consistency?
If we read an object after updating, we might get the older version ex: (PUT 200 => PUT 200 => GET 200 (might be older version))
58
How is in S3 Read after deleting an object consistency?
If we delete an object, we might still be able to retrieve it for a short time
ex: (DELETE 200 => GET 200)
59
How can I request S3 strong consistency?
there is no way to request
60
What you need to use MFA-Delete on S3?
to have versioning enabled in the bucket
61
When you will need MFA on S3?
* permanently delete an object version
| * suspend versioning on the bucket
62
Who can enable/disable MFA-Delete?
Only the bucket owner (root account)
63
How can you enable MFA-Delete?
only by using the CLI
64
What is evaluated before S3 default encryption?
Bucket policies, it was the old way to enable default encryption
65
What you should not use as your logging bucket?
your monitored bucket, it will create a logging loop, and your bucket will grow exponentially
66
What condition must be accomplished by 2 buckets involved in S3 replication?
Both must enable versioning
67
Can you set S3 replications cross accounts?
yes
68
How is data copied in S3 replication?
async, but it is very quick
69
What condition must be accomplished by the bucket containing the data in S3 replication?
Must have proper IAM permission behind an IAM Role
70
What happens to the objects when you activate S3 replication?
new objects are replicated, it is not retroactive
71
What happens when you have S3 replication and you delete an object version
it is not replicated
72
It is S3 replication transitive?
No
73
How can you generate S3 pre-signed URLs?
using SDK or CLI
74
What is the default expiration time of S3 pre-signed URLs?
3600 s
75
What are the permissions of the person that a S3 Pre-signed URL was given to?
They inherit the permissions of the person who generated the URL for GET / PUT
76
What you must use to create a S3 Pre-signed URL for uploads?
SDK
77
What are the S3 Storage classes?
* Amazon S3 Standard - General Purpose
* Amazon S3 Standard-Infrequent Access (IA)
* Amazon S3 One Zone-Infrequent Access
* Amazon S3 Intelligent Tiering
* Amazon Glacier
* Amazon Glacier Deep Archive
78
How are files called in S3 Glacier and where are stored?
Archives and stored in Vaults
79
What you need to pay for using S3 Intelligent Tiering Storage Class?
Small montly monitoring and auto-tiering fee
80
Which are the retrieval options for S3 Amazon Glacier?
- Expedited
- Standard
- Bulk
81
What is the time to get the data for Amazon Glacier Expedited?
1 - 5 min
82
What is the time to get the data for Amazon Glacier Standard?
3 - 5 hours
83
What is the time to get the data for Amazon Glacier Bulk?
5 - 12 hours
84
What is the time to get the data for Amazon Glacier Deep Archive Standard?
12 hours
85
What is the time to get the data for Amazon Glacier Deep Archive Bulk?
48 hours
86
Which are the retrieval options for S3 Amazon Glacier Deep Archive?
- Standard
| - Bulk
87
Which is the minimum storage duration for S3 Amazon Glacier?
90 days
88
Which is the minimum storage duration for S3 Amazon Glacier Deep Archive?
180 days
89
What is S3 Lifecycle Configuration?
a set of rules that define actions that Amazon S3 applies to a group of objects to manage your objects so that they are stored cost effectively
90
What are the 2 types of actions in S3 Lifecycle Configuration?
- Transition Actions
| - Expiration Actions
91
What is S3 lifecycle configuration transition actions?
```
It defines when objects are transitioned to another storage class.
• Move objects to Standard IA class 60 days after creation
• Move to Glacier for archiving after 6 months
```
92
What is S3 lifecycle configuration expiration actions?
configure objects to expire (delete) after some time
• Access log files can be set to delete after a 365 days
• Can be used to delete old versions of files (if versioning is enabled)
• Can be used to delete incomplete multi-part uploads
93
What can you use to apply S3 lifecycle configuration actions?
prefixes and tags
94
What is the max amount of prefixes allowed in a bucket?
no limit
95
What encryption method might impact your S3 performance baseline in extreme performance scenarios?
SSE-KMS becuse of their quota
96
When is recommended to use S3 multi-part upload?
recommended for > 100MB because it parallelizes the uploads
97
What is S3 Transfer Acceleration?
Increase transfer speed (just uploads) by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region. It is compatible with multi-part upload
98
What can you use to accelerate your upoads to S3?
S3 Transfer Acceleration
99
What can you use to accelerate your downloads from S3?
S3 byte-range fetches
100
What is S3 byte-range fetches?
parallelize GETs by requesting specific byte ranges
101
What can you use to request just for the header of a file in S3?
S3 byte-range fetches
102
What is S3 Select and Glacier Select?
enables applications to retrieve only a subset of data from an object by using simple SQL expressions
103
What are the advantages of using S3 Select?
Less network transfer and less CPU cost client side
104
Set an example of two S3 events
S3:ObjectCreated
S3:ObjectRemoved
105
In what time are S3 Event notifications delivered?
Typically in seconds but can sometimes take a minute or longer
106
What are S3 event notifications?
The Amazon S3 notification feature enables you to receive notifications when certain events happen in your bucket
107
What can you do to ensure that an event notification is sent for every successful write?
you can enable versioning on your bucket.
108
What are the destinations supported by S3 event notification?
SNS
SQS
Lambda Functions
109
What is Athena?
Serverless service to perform analytics directly against S3 files
110
What language is used by Athena?
SQL
111
What is the exam tip for Athena?
Analyze data direclty on S3
112
How can you connect externally to Athena
Using a JDBC / ODBS driver
113
What format(s) supports Athena?
A lot (CSV, JSON, ORC, Avro, and Parquet (built on Presto))
114
How are you charged in Athena?
per query and amount of data scanned
115
What is S3 Object lock?
feature that blocks object version deletion during a customer-defined retention period
116
What is S3 Glacier Vault lock?
allows you to lock your vault
117
What is the model adopted by S3 Object Lock and S3 Glacier Vault Lock?
write-once-read-many (WORM)
118
What is great for S3 Cross Region Replication?
Great for dynamic content that needs to be available at low-latency in few regions
119
Which is the minimum storage duration for S3 Standard IA?
30 days
120
How can you mount a file system in S3?
you can't
121
Can you move data directly to Galcier Deep Archive from any other tier?
yes
122
What is the order of the S3 storage classes?
You can move data from up to down but no otherwise:
- Standard
- Standard IA
- Intelligent Tiering
- One Zone IA
- Glacier
- Glacier Deep Archive
123
What is S3 baseline performance for reads?
5,500 GET/HEAD requests per second per prefix in a bucket
124
What is S3 baseline performance for writes?
3,500 PUT/COPY/POST/DELETE requests per second per prefix in a bucket
