<h1>S3 Simple Storage Service</h1>
The oldest of services in AWS. It stores objects, so docs, images, web files and other static data types. You can not install software or a os. It has unlimited storage for both data and objects. Objects can range in size from 0 bytes to 5 terra bytes. A "bucket" is basically a folder.
Working with S3
<ul>
<li>The s3 is a universal namespace. So names must be unique.</li>
<li>Objects are stored in a key, value, system. For example, you upload a picture of you dog named molly.jpg. Then the key would be "molly.jpg" and the value would be the data of that image.</li>
<li>An example url:
<pre><code>https://bucket-name.s3.Region.amazon.com/key-name;
https://my-pets.s3.us-east1.amazon.com/molly.jpg
</code></pre>
</li>
<li>after uploading a file your browser will receive a 200 code if successful.</li>
<li>The version id is used in duplicate objects or multiple versions of the same object.</li>
<li>Meta Data is data about data. It can include the date it was created and / or date the object was uploaded, or the content type and much more.</li>
<li>Data is safe and secure and spread across multiple devices and facilities to ensure availability and durability.</li>
<li>depending on the tier, built for 99.95% to 99.99% service availability and 99.(9 nines) durability in data stored</li>
</ul>
<h2>S3 Standard</h2>
<ul>
<li>High availability and durability
<ul>
<li>Data is stored redundantly across multiple devices in multiple facilities ( >= 3 AZs).
<ul>
<li>99.99% availability</li>
<li>(11 nines) durability</li>
</ul>
</li>
</ul>
</li>
<li>Designed for Frequent access</li>
<li>Suitable for most workloads
<ul>
<li>default storage</li>
<li>cases may include websites, game applications, content distribution, big data analytics</li>
</ul>
</li>
</ul>
Tiered Storage
Standard is good for most use cases, but not all and there are various tiers available.
Lifecycle Management
Define rules to automatically transition objects to a cheaper storage tier or delete objects that are no longer required after a set period of time.
Versioning
With Versioning, all versions of a object are stored and can be retrieved, including deleted objects.
<h2>Securing data</h2>
Server-Side Encryption
You can set default encryption on a bucket to encrypt objects when they are stored.
All buckets are private by default.
Access Control Lists ( ACL )
Define which AWS accounts or groups have access and what type of access. You can attach ACL to specific s3 buckets as well.
<ul>
<li>ACL work on a individual object level.</li>
<li>You can make an object, in the bucket, public with ACL</li>
</ul>
Bucket Policies
bucket policies specify what actions are allowed or denied.
<ul>
<li>apply to the entire bucket</li>
<li>You can make the entire bucket public</li>
</ul>
Strong read after write
after the successful write of a new object or update (put) to an object, you can immediately receive the latest or newest object. Strong Consistency allows you to immediately list all objects after object updates or writing new objects, to see all objects.
<h2>Static Website</h2>
You can host a static website in a s3 bucket. Few things to keep in mind. These sites must be static and not dynamic, so no database connections. They scale automatically. A good example would be a movie premier site. Whether one person or millions view the site, it will be accessible.
<ul>
<li>
Create the bucket and make it public.
</li>
<li>
Now you can upload your files.
</li>
<li>
Go to properties tab and at the bottom, click to enable the static website.
</li>
<li>
You want to set the name for the main or home page, which is typically called "index", as well as give the redirect for the error page.
</li>
<li>
under permissions for the bucket, create a policy to allow the files in the bucket to have public access. The json would look like this:
<pre><code>{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "PublicReadGetObject",
 "Effect": "Allow",
 "Principal": "*",
 "Action": [
 "s3GetObject"
 ],
 "Resources": [
 "arn:aws:s3:::BUCKET_NAME/*"
 ]
 }
 ]
}
</code></pre>
The above code snippet will ensure all objects inside the bucket have public access. This will create, or flag a ui component, warning, to warn that the bucket and all the data is open to the public.
Now you can return to the properties tab and return to the static site section. Click on the url for the site and view it.
</li>
</ul>
<h2>Versioning</h2>
<ul>
<li>Versioning is a great backup tool. All versions of the object are stored in the bucket.</li>
<li>Once versioning is turned on, it can not be turned off or disabled, it can be suspended.</li>
<li>It can be integrated with lifecycle rules.</li>
<li>It does support MFA</li>
</ul>
<h2>S3 Tiers</h2>
standard and intelligent do not have retrieval cost, all the rest do.
S3 standard
<ul>
<li>highest cost, but the more data you store the less the cost.
S3 Intelligent
uses machine learning to give you the best cost depending on how often you access you data.</li>
<li>monthly fee of 0.0025 per 1,000 objects</li>
</ul>
S3 standard IA
Infrequent Access
<ul>
<li>used if you need quick access but not frequent access.</li>
<li>low per gb charge for storage and retrieval.</li>
<li>good for long-term storage, diaster recovery, back ups</li>
</ul>
S3 One Zone IA
<ul>
<li>cost 20% less than standard IA but data will be restricted to one AZ, so dependability goes down.</li>
<li>great for non-critical data.</li>
<li>95.99% availability</li>
</ul>
S3 Glacier
<ul>
<li>cheap storage</li>
<li>access data only a few times a year</li>
<li>specific for archiving</li>
<li>retrieve time 1 min to 12 hours</li>
</ul>
S3 Glacier Deep Archive
<ul>
<li>retrieve data time 12 + hours by default</li>
</ul>
<h2>Lifecycle Management</h2>
Withing the s3 bucket you can set up policy that effects the whole bucket or objects in the bucket, to move them to different tiers after so long to save money.
For example, you can set up a lifecycle policy that looks at the entire bucket and moves objects that have not been accessed for longer than 30 days to IA and then from IA to Glacier after 90 days.
<h2>Object locks &#x26; Glacier Locks</h2>
You can store objects using the write once, read many (WORM) model. Can be applied to single object or the bucket. This is locking the object and protects it from deletion or updating for a specified amount of time. Two modes to this:
<ul>
<li>Governance Mode - Only a few with specific permissions can update or delete the object.</li>
<li>Compliance Mode - No one, not even root can update or delete the object until the time is up.</li>
</ul>
Glacier Vault Lock is compliance mode for glacier storage tier.
Legal Lock can be placed or removed by anyone with the s3:PutObjectLegalHold permission on any object or glacier lock. It prevents updates or deletes until removed.
<h2>Encryption</h2>
<ul>
<li>encrypt in transit
<ul>
<li>ssl/tls</li>
<li>https</li>
</ul>
</li>
<li>encryption at rest
<ul>
<li>server-side encryption</li>
<li>sse-s3 (AES 256-bit) default</li>
<li>sse-KMS use kms from amazon to provide you with keys</li>
<li>sse-c you get and handle the keys</li>
</ul>
</li>
<li>Client side encryption
<ul>
<li>you encrypt yourself before uploading</li>
</ul>
</li>
<li>Enforcing encryption with bucket policy
<ul>
<li>bucket can deny all PUT request that don't include the x-amz-server-side-encryption parameter in the request header</li>
</ul>
</li>
</ul>
<h2>Optimize S3</h2>
<ul>
<li>prefix will increase your request per second and a prefix is a folder inside the bucket.</li>
<li>3,500 request per second (rps) put/copy/post/delete and 5,500 get/head rps per prefix.</li>
<li>spreading your reads across different prefixes increase your rps.</li>
<li>KMS encryption has limits that are region specific, either 5,500, 10,000, or 30,000 rps. You can not request a increase in limits for KMS</li>
<li>use multipart uploads for over 100MB and must
be used for over 5G.</li>
<li>use s3-byte-range fetches when downloading file.</li>
</ul>
<h1>S3 Replication</h1>
used to be called cross region replication
<ul>
<li>you can replicate a object in one bucket to another bucket</li>
<li>existing objects in a bucket are not replicated automatically. If you have objects in the bucket when you decide to turn on replication, they will not be replicated.</li>
<li>Delete markers are not replicated by default.</li>
</ul>

S3 buckets are public by default, so don't need to do anything to allow this.

Open them up! They said it was ok, right?!

Ask your boss to bring in a stack of floppy disks to transport to and from the office.

Explain to your boss that this is a terrible idea and opens a huge security risk for the company.

It is not possible since versioning was suspended. The object is gone.

Look in the bucket named s3-backup. The object will be in there and can be restored to the original bucket.

Disabled or not, versioning doesn't protect against deletions. The object is gone forever.

Re-enable versioning and remove the delete marker to restore the object.

s3 Quiz

1 of 5 Score: 0

Your boss instructs you to open up all of your company's S3 buckets so they can download content when they are at home. What do you do?