110 lines (81 loc) · 3.7 KB

AWS S3 — Simple Storage Service

Overview

Amazon S3 allows people to store objects (files) in "buckets" (directories)
Buckets must have a globally unique name (across all regions and all accounts)
Buckets are defined at the region level
S3 looks like a global service but buckets are created in a region
By default, you can create up to 100 buckets per AWS account per region

Objects

Objects (files) have a Key, which is the FULL path
Max Object Size is 5TB (5000GB)
If uploading more than 5GB, must use "multi-part upload"

Security

User-Based

IAM Policies – which API calls should be allowed for a specific user from IAM

Resource-Based

Bucket Policies – bucket-wide rules from the S3 console; allows cross-account access
Object Access Control List (ACL) – finer grain (can be disabled)
Bucket Access Control List (ACL) – less common (can be disabled)

Access Rule

An IAM principal can access an S3 object if:

The user IAM permissions ALLOW it OR the resource policy ALLOWS it

AND there's no explicit DENY

Encryption

Encrypt objects in Amazon S3 using encryption keys

Bucket Policies

JSON-based policies
Resources: buckets and objects
Effect: Allow / Deny
Actions: Set of API calls to Allow or Deny
Principal: The account or user to apply the policy to

Use S3 Bucket Policies to:

Grant public access to the bucket
Force objects to be encrypted at upload
Grant access to another account (Cross Account)

S3 Durability and Availability

Durability

High durability (99.999999999%, 11 9's) of objects across multiple AZs
If you store 10,000,000 objects, you can on average expect to lose a single object once every 10,000 years
Same for all storage classes

Availability

Measures how readily available a service is
Varies depending on storage class
Example: S3 Standard has 99.99% availability = not available 53 minutes a year

S3 Storage Classes

S3 Standard – General Purpose

99.99% Availability
Used for frequently accessed data
Low latency and high throughput
Sustains 2 concurrent facility failures
Use cases: Big Data analytics, mobile & gaming applications, content distribution

S3 Infrequent Access (S3-IA)

For data that is less frequently accessed, but requires rapid access when needed
Lower cost compared to Standard
S3 Standard-IA: 99.9% Availability — great for disaster recovery, backups
S3 One Zone-IA: 99.5% Availability — data lost when AZ is destroyed; secondary backup copies of on-premises data

S3 Glacier Storage Classes (Archiving)

Low-cost object storage meant for archiving/backup
Pricing: price for storage + object retrieval cost

Class	Retrieval Time
Glacier Instant Retrieval	Milliseconds; great for data accessed once a quarter; minimum 90-day storage
Glacier Flexible Retrieval	Expedited (1–5 min), Standard (3–5 hrs), Bulk (5–12 hrs); minimum 90-day storage
Glacier Deep Archive	Standard (12 hrs), Bulk (48 hrs); minimum 180-day storage

S3 Intelligent-Tiering

Small monthly monitoring and auto-tiering fee
Moves objects automatically between Access Tiers based on usage
No retrieval charges
Tiers: Frequent Access (default), Infrequent Access (not accessed for 30 days), Archive Instant (90 days), Archive Access (90–700+ days), Deep Archive (180–700+ days)

S3 Soft Limits

Resource	Limit
Buckets per AWS account	100
Objects per bucket	Unlimited
Object size limit	5 TB
Snapshots per region	10,000