AWS - Module 8 - Simple Storage Services - RM - Final

AWS Foundation and Architecture
Module 8: Simple Storage Services
1
©COPYRIGHT 2017, ALL RIGHTS RESERVED. MANIPAL GLOBAL EDUCATION SERVICES PVT. LTD.
Table of Contents
8.1. Introduction to Object Storage ........................................................................................... 4
8.2. S3: Data Consistency Models in Distributed Storage Systems ...................................... 4
8.3. AWS S3 Buckets ................................................................................................................... 4
8.4. S3 Objects .............................................................................................................................. 5
8.5. S3 Managing Access and Access Policies ......................................................................... 5
8.6. AWS S3 Access Policy types ............................................................................................... 6
8.7. S3: Understanding Bucket and Object ACLs: Closer Look ............................................ 7
8.8. Bucket Versioning (S3 Bucket Sub-resource) ................................................................... 9
8.9. S3: Copying or Uploading S3 Objects ............................................................................. 10
8.10. S3: Storage Tiers or Classes............................................................................................... 11
8.11. Glacier .................................................................................................................................. 12
8.12. Glacier: Archive Retrieval in Glacier ............................................................................... 14
8.13. S3 Bucket Lifecycle Policies .............................................................................................. 15
8.14. S3 Server Side Encryption (SSE)....................................................................................... 16
8.15. S3: Static Website Hosting in an S3 Bucket..................................................................... 17
8.16. S3: Pre-Signed URLs ........................................................................................................... 17
8.17. S3: Cross Region Replication (CRR) ................................................................................. 18
8.18. S3: Transfer Acceleration ................................................................................................... 19
8.19. S3: Performance Considerations ....................................................................................... 20
8.20. S3: Billing .............................................................................................................................. 20
8.21. S3: Notification ..................................................................................................................... 21
8.22. S3: Monitoring ...................................................................................................................... 21
2
Introduction
Amazon Simple Storage Service (Amazon S3) is storage for the Internet. You can use
Amazon S3 to store and retrieve any amount of data at any time, from anywhere on
the web. You can accomplish these tasks using the AWS Management Console
which is a simple and intuitive web interface. This guide introduces you to Amazon
S3 and how to use the AWS Management Console to complete the tasks.
Learning Objectives
Upon completion of this module, you will be able to:

• Explain Amazon S3 Cloud storage service
• List the features of AWS S3
• List the pricing of AWS S3 and how is it better than its competitors
3
8.1. Introduction to Object Storage

Amazon S3 is an object storage built to store and retrieve any amount of data
from anywhere such as websites and mobile apps, corporate applications, and
data from IoT sensors or devices. It is designed to deliver 99.999999999%
durability and stores data for millions of applications used by market leaders in
every industry. S3 provides comprehensive security and compliance capabilities
that meet even the most stringent regulatory requirements. It gives customers
flexibility to manage data for cost optimization, access control, and compliance.
8.2. S3: Data Consistency Models in Distributed Storage Systems

Amazon S3 provides read-after-write consistency for PUTS of new objects in
your S3 bucket and eventual consistency for overwrite PUTS and DELETES in
all regions. So, if you add a new object to your bucket, you and your clients will
see it. But, if you overwrite an object, it might take some time to update its
replicas. Hence the eventual consistency model is applied.
Amazon S3 guarantees high-availability by replicating data across many servers
and AZs. It is obvious that data integrity should be maintained if a new record is
added or a record/data is updated and deleted. The scenarios for above cases are
as follows:
• A new PUT request is made. The object might not appear in the list if
queried immediately until the changes are propagated to all the servers
and AZs. The read-after-write consistency model is applied here.
• An UPDATE request is made. As eventual consistency model is applied
for UPDATEs, a query to list the object might return an old value.
• A DELETE request is made. As eventual consistency model is applied for
DELETEs, a query to list or read the object might return the deleted
object.
8.3. AWS S3 Buckets

Amazon Simple Storage Service is storage for the Internet. It is designed to make
web-scale computing easier for the developers.
Amazon S3 has a simple web service interface that you can use to store and
retrieve any amount of data, at any time, from anywhere on the web. It gives
any developer the access to highly scalable, reliable, fast, inexpensive data
storage infrastructure that Amazon uses to run its own global network of
websites. The service aims to maximize the benefits of scale and to pass those
benefits on to the developers.
4
Advantages of Amazon S3
Amazon S3 is intentionally built with a minimal feature set that focuses on
simplicity and robustness.
Some of the advantages of the Amazon S3 services are as follows:
• Create Buckets: Create and name a bucket that stores data. Buckets are
the fundamental container in Amazon S3 for data storage.
• Store data in Buckets: Store an infinite amount of data in a bucket.
Upload as many objects as you like into an Amazon S3 bucket. Each
object can contain up to 5 TB of data. Each object is stored and retrieved
using a unique developer-assigned key.
• Download data: Download your data or enable others to do so.
Download your dataany time you like or allow others to do the same.
• Permissions: Grant or deny access to others who want to upload or
download data into your Amazon S3 bucket. Grant upload and
download permissions to three types of users. Authentication
mechanisms can help to keep the data secure from unauthorized access.
• Standard interfaces: Use standard based REST and SOAP interfaces
designed to work with any Internet-development toolkit.
8.4. S3 Objects
A bucket is a container for objects stored in Amazon S3. Every object is
contained in a bucket. For example, if the object named photos/puppy.jpg is
stored in John Smith’s bucket, then it is addressable using the URL:
http://johnsmith.s3.amazonaws.com/photos/puppy.jpg
Buckets serve several purposes such as:
• Organize the Amazon S3 namespace at the highest level
• Identify the account responsible for storage and data transfer charges
• Play a role in access control
• Serve as the unit of aggregation for usage reporting
You can configure buckets so that they are created in a specific region.
8.5. S3 Managing Access and Access Policies

Managing access refers to granting others (AWS accounts and users) permission
to perform the resource operations by writing an access policy. For example, you
can grant PUT Object permission to a user in an AWS account so the user can
upload objects to your bucket. In addition to granting permissions to individual
users and accounts, you can grant permissions to everyone (also referred as
anonymous access) or to all authenticated users (users with AWS credentials).
For example, if you configure your bucket as a website, you want to make
objects public by granting the GET Object permission to everyone.
5
8.6. AWS S3 Access Policy types

Access policy describes who has access to what. You can associate an access
policy with a resource (bucket and object) or a user. Accordingly, you can
categorize the available Amazon S3 access policies as follows:
• Resource-based policies: Bucket policies and Access Control Lists (ACLs)
are resource-based because you can attach it to your Amazon S3
resources.
• ACL: Each bucket and object has an ACL associated with it. An ACL is a
list of grants identifying grantee and permission granted. You can use
ACLs to grant basic read or write permissions to other AWS accounts.
ACLs use an Amazon S3 specific XML schema. The grant in the ACL
shows a bucket owner as having full control permission.
• Bucket Policy: For your bucket, you can add a bucket policy to grant
other AWS accounts or IAM user’s permissions for the bucket and the
objects in it. Any object permissions apply only to the objects that the
bucket owner creates. Bucket policies supplement and in many cases,
replace ACL based access policies.
The following is an example of bucket policy. You can express bucket
policy and user policy using a JSON file. The policy grants anonymous
read permission on all the objects in a bucket. The bucket policy has one
statement which allows the s3:GetObjectaction (read permission) on
objects in a bucket named examplebucket. By specifying the principle
with a wild card (*), the policy grants anonymous access.
User policies: You can use IAM to manage access to your Amazon S3
resources. You can create IAM users, groups, and roles in your account
and attach access policies to them by granting the access to AWS
resources, including Amazon S3.
6
8.7. S3: Understanding Bucket and Object ACLs: Closer Look

Amazon Simple Storage Service (Amazon S3) is a storage for the Internet. You
can use Amazon S3 to store and retrieve any amount of data anytime from
anywhere on the web. You can accomplish these tasks using the AWS
Management Console which is a simple and intuitive web interface. This guide
introduces you to Amazon S3 and how to use the AWS Management Console to
complete the tasks as shown in the given figure:
To create an S3 bucket:
1. Sign in to the AWS Management Console and open the Amazon S3
console
2. Click Create bucket
3. In the Bucket name field, type a unique DNS-compliant name for the new
bucket
4. For Region, select US West (Oregon) as the region where the bucket must
reside
5. Click Create
Add an Object to a Bucket
Now you have created a bucket, you are ready to add an object to it. An object
can be any kind of file such as a text file, a photo, a video, and so on.
To upload an object to a bucket:
1. In the Bucket name list, select the name of the bucket to upload your
object
2. Click Upload
3. In the Upload dialog box, click Add files to select the file to upload
4. Select a file to upload, and then click Open
5. Click Upload
View an Object
To download an object from a bucket:
1. In the Bucket name list, select the name of the bucket that you have
created.
2. In the Name list, select the check box next to the object that you have
uploaded, and then click Download on the object overview panel.
7
Move an Object
To copy an object:
1. Select the name of the bucket created in the Bucket name list
2. Click Create Folder, type favorite-pics for the folder name, and then
click Save
3. Select the check box in the Name list, next to the object to be copied,
click More, and then select Copy.
4. Select the name of the folder favorite-pics in the Name list.
5. Click More and then select Paste.
6. Click Paste
Delete an Object and Bucket
If you no longer need to store the object that you have uploaded and made a
copy of it while going through this guide, you should delete the objects to
prevent further charges.
You can delete the objects individually or you can empty a bucket which deletes
all the objects in the bucket without deleting the bucket.
To delete an Object from a Bucket
1. Select the name of the bucket in the Bucket name list that you want to
delete an object from.
2. Select the check box in the name list, next to the object that you want to
delete, click More, and then select Delete.
3. Verify that the name of the object you selected for deletion in the Delete
objects dialog box is listed, and then click Delete.
How to Specify an ACL?
Amazon S3 APIs enables you to set an ACL when you create a bucket or an
object. Amazon S3 also provides API to set an ACL on an existing bucket or an
object.
These APIs provide the following methods to set an ACL:
• Set ACL using request headers: When you send a request to create a
resource (bucket or object), you set an ACL using the request headers.
Using these headers, you can either specify a canned ACL or specify
grants explicitly (identifying grantee and permissions explicitly).
• Set ACL using request body: When you send a request to set an ACL on
an existing resource, you can set the ACL either in the request header or
in the body.
8
When to use Access Control Lists with Buckets and Object

Access Control Lists (ACLs) are one of the resource-based access policy options
that can be used to manage access to your buckets and objects. You can use
ACLs to grant basic read/write permissions to other AWS accounts. There are
limits for managing permissions using ACLs. For example, you can grant
permissions only to other AWS accounts; you cannot grant permissions to users
in your account. You cannot grant conditional permissions, nor can you
explicitly deny permissions. ACLs are suitable for specific scenarios. For
example, if a bucket owner allows other AWS accounts to upload objects,
permissions to these objects can only be managed using object ACL by the AWS
account that owns the object.
8.8. Bucket Versioning (S3 Bucket Sub-resource)

Versioning is a means of storing multiple variants of an object in the same
bucket. You can use versioning to preserve, retrieve, and restore every version
of objects stored in your Amazon S3 bucket. With versioning, you can easily
recover from both unintended user actions and application failures.
For example, in one bucket you can have two objects with the same key, but
different version IDs such as photo.gif (version 111111) and photo.gif (version
121212).
Versioning-enabled buckets help you to recover objects from accidental deletion

or overwrite.
For example:
• If you delete an object instead of removing it permanently, Amazon S3
inserts a delete marker which becomes the current object version. You can
always restore the previous version.
• If you overwrite an object, it results in a new object version in the bucket.
You can always restore the previous version.
Important
If you have an object expiration lifecycle policy in your non-versioned bucket
and you want to maintain the same permanent delete behavior when you enable
versioning, you must add a non-current expiration policy. The non-current
9
expiration lifecycle policy will manage the deletes of the non-current object
versions in the version-enabled bucket which can be in one of three states:
unversioned (the default), versioning-enabled, or versioning-suspended.
Important
Once you version-enable a bucket, it can never return to an unversioned state.
However, You can suspend versioning on that bucket.
The versioning state applies to all (never some) of the objects in that bucket. The
first time you enable a bucket for versioning, objects in it are thereafter
versioned always and given a unique version ID.
Note:
• Objects stored in your bucket before you set the versioning state have a
version ID of null. When you enable versioning, existing objects in your
bucket do not change. What changes is how Amazon S3 handles the
objects in future requests.
• The bucket owner or any user with appropriate permissions can suspend
versioning to stop accruing object versions. When you suspend
versioning, existing objects in your bucket do not change. What changes
is how Amazon S3 handles objects in future requests.
8.9. S3: Copying or Uploading S3 Objects

The copy operation creates a copy of an object that is already stored in Amazon
S3. You can create a copy of your object up to 5 GB in a single atomic operation.
However, for copying an object that is greater than 5 GB, you must use the
multipart upload API.
Using the copy operation, you can:
• Create additional copies of objects.
• Rename objects by copying them and deleting the original ones.
• Move objects across Amazon S3 locations (example: us-west-1 and EU).
• Change object metadata.
Each Amazon S3 object has metadata. It is a set of name-value pairs. You can set
object metadata at the time you upload it. After you upload the object, you
cannot modify object metadata. The only way to modify object metadata is to
make a copy of the object and set the metadata. In the copy operation, you can
set the same object as the source and target.
Each object has metadata. Some of it is system metadata and other is user-
defined. Users control some of the system metadata such as storage class
configuration to use for the object, and configure server-side encryption. When
you copy an object, user-controlled system metadata and user-defined metadata
are also copied. Amazon S3 resets the system-controlled metadata. For example,
10
when you copy an object, Amazon S3 resets the creation date of the copied
object. You don't need to set any of these values in your copy request.
When copying an object, you might decide to update some of the metadata
values. For example, if your source object is configured to use standard storage,
you might choose to use reduced redundancy storage for the object copy. You
might also decide to alter some of the user-defined metadata values present on
the source object.
Note:
If you choose to update any of the object's user-configurable metadata (system
or user-defined) during the copy, then you must explicitly specify all the user-
configurable metadata present on the source object in your request, even if you
are changing only one of the metadata values.
8.10. S3: Storage Tiers or Classes

• Amazon S3 storage classes are designed to sustain the concurrent loss of
data in one or two facilities.
• S3 storage classes allow lifecycle management for automatic migration of
objects for cost savings.
• S3 storage classes support SSL encryption of data in transit and data
encryption at rest.
• S3 also regularly verifies the integrity of your data using checksums and
provides auto healing capability.
Standard
• Storage class is ideal for performance-sensitive use cases and frequently
accessed data and is designed to sustain the loss of data in a two facilities
• STANDARD is the default storage class, if none specified during upload
• Low latency and high throughput performance
• Designed for durability of 99.999999999% of objects
• Designed for 99.99% availability over a given year
• Backed with the Amazon S3 Service Level Agreement for availability.
Standard IA
• S3 Standard IA (Infrequent Access) storage class is optimized for long-

lived and less frequently accessed data. For example, backups and older data
where access is limited, but the use case still demands high performance.
• Standard IA is designed to sustain the loss of data in two facilities.
• Standard IA objects are available for real-time access.
• Standard IA storage class is suitable for larger objects greater than 128 KB
(smaller objects are charged for 128KB only) kept for at least 30 days.
• Same low latency and high throughput performance of Standard.
• Designed for durability of 99.999999999% of objects.
11
• Designed for 99.9% availability over a given year.

• Backed with the Amazon S3 Service Level Agreement for availability.
Reduced Redundancy Storage: RRS
• Reduced Redundancy Storage (RRS) class is designed for non-critical,
reproducible data stored at lower levels of redundancy than the Standard
storage class which reduces storage costs.
• Designed for 99.99% availability over a given year.
• Lower level of redundancy results in less durability and availability.
• RRS stores objects on multiple devices across multiple facilities providing
400 times the durability of a typical disk drive.
• RRS does not replicate objects as many times as S3 standard storage
and is designed to sustain the loss of data in a single facility.
• If an RRS object is lost, S3 returns a 405 error on requests made to that
object.
• S3 can send an event notification which is configured on the bucket to
alert a user or start a workflow when it detects that an RRS object is lost
which can be used to replace the lost object.
Glacier
• Glacier storage class is suitable for archiving data where data access is
infrequent and retrieval time of 3-5 hours is acceptable.
• Glacier storage class uses very low-cost Amazon Glacier storage service,
but the objects in this storage class are still managed through S3.
• Glacier cannot be specified as the storage class at the object creation time
but has to be transitioned from Standard, RRS, or Standard IA to Glacier
storage class using lifecycle management.
• For accessing Glacier objects,
o Object must be restored which can be taken anywhere between 3-5
hours.
o Objects are only available for the time period (number of days)
specified during the restoration request.
o Objects storage class remains Glacier
o Charges are levied for both the archive (Glacier rate) and the copy
restored temporarily (RRS rate)
• Vault Lock feature enforces compliance via lockable policy.
8.11. Glacier
Amazon Glacier is an extremely low-cost storage service that provides durable
storage with security features for data archiving and backup. With Amazon
Glacier, customers can store their data cost effectively for months, years, or even
12
decades. Amazon Glacier enables the customers to offload the administrative

burdens of operating and scaling storage to AWS, so they don't have to worry
about capacity planning, hardware provisioning, data replication, hardware
failure detection and recovery or time-consuming hardware migrations.
Benefits
• Retrievals as Quick as 1-5 Minutes
Amazon Glacier provides three retrieval options to fit your use case.
Expedited retrievals typically return data in 1-5 minutes and are great
for Active Archive use cases. Standard retrievals typically complete
between 3-5 hours’ work, and work well for less time-sensitive needs
such as backup data, media editing or long-term analytics. Bulk retrievals
are the lowest-cost retrieval option, returning large amounts of data
within 5-12 hours.
• Unmatched Durability and Scalability
Amazon Glacier runs on the world’s largest Global Cloud infrastructure,
and was designed for 99.999999999% of durability. Data is automatically
distributed across a minimum of three physical Availability Zones that
are geographically separated within an AWS region, and Amazon Glacier
can also automatically replicate the data to any other AWS region.
• Most Comprehensive Security and Compliance Capabilities
Amazon Glacier offers sophisticated integration with AWS CloudTrail to
log, monitor, and retain storage API call activities for auditing and
support three different forms of encryption. Amazon Glacier also
supports security standards and compliance certifications including SEC
Rule 17a-4, PCI-DSS, HIPAA/HITECH, FedRAMP, EU Data Protection
Directive, and FISMA, and Amazon Glacier Vault Lock enables WORM
storage capabilities which helps to satisfy the compliance requirements
for every regulatory agency virtually around the globe.
13
• Low Cost
Amazon Glacier is designed to be the lowest cost AWS object storage
class which allows you to archive large amounts of data at a very low
cost. This makes it feasible to retain all the data you want for use cases
such as data lakes, analytics, IoT, machine learning, compliance, and
media asset archiving. You pay only for what you need with no
minimum commitments or up-front fees.
• Most Supported Platform with the Largest Ecosystem
In addition to integration with most AWS services, the Amazon object
storage ecosystem includes tens to thousands of consulting, systems
integrator, and independent software vendor partners with more joining
every month. AWS Marketplace offers 35 categories and more than 3,500
software listings from over 1,100 ISVs that are pre-configured to deploy
on the AWS Cloud. AWS Partner Network partners have adapted their
services and software to work with Amazon S3 and Amazon Glacier for
solutions such as Backup and Recovery, Archiving, and Disaster
Recovery. No other Cloud provider has more partners with solutions that
are pre-integrated to work with their service.
• Query In Place
Amazon Glacier is the only Cloud archive storage service that allows you
to query data in place and retrieve only the subset of data you need from
an archive. Amazon Glacier Select helps you to reduce the total cost of
ownership by extending your data lake into cost-effective archive storage.
8.12. Glacier: Archive Retrieval in Glacier

Retrieving an archive from Amazon Glacier is an asynchronous operation in
which you first initiate a job, and then download the output after the job
completes.
Archive Retrieval Options
You can specify one of the following when initiating a job to retrieve an archive
based on your access time and cost requirements.
• Expedited: Expedited retrievals allow you to quickly access your data
when occasional urgent requests for a subset of archives are required. For
all but the largest archives (250 MB+), data accessed using Expedited
retrievals are typically made available within 1–5 minutes. There are two
types of Expedited retrievals, namely On-Demand and Provisioned. On-
Demand requests are similar to EC2 On-Demand instances and are
available most of the time. Provisioned requests are guaranteed to be
available when you need them.
• Standard: Standard retrievals allow you to access any of your archives
within several hours. Standard retrievals typically complete within 3–5
14
hours. This is the default option for retrieval requests that do not specify
the retrieval option.
• Bulk: Bulk retrievals are Amazon Glacier’s lowest-cost retrieval option
which can be used to retrieve large amounts, even petabytes of data
inexpensively in a day. Bulk retrievals typically complete within 5–12
hours.
To make an Expedited, Standard, or Bulk retrieval, set the Tier parameter in
the Initiate Job (POST jobs) REST API request to the option you want, or the
equivalent in the AWS CLI or AWS SDKs. You don't need to designate whether
an expedited retrieval is On-Demand or Provisioned. If you have purchased
provisioned capacity, then all expedited retrievals are automatically served
through your provisioned capacity.
Ranged Archive Retrievals
When you retrieve an archive from Amazon Glacier, you can optionally specify
a range, or portion, of the archive to retrieve. The default is to retrieve the whole
archive.
Specifying a range of bytes can be helpful when you want to do the following:
• Manage your data downloads: Amazon Glacier allows retrieved data to
be downloaded for 24 hours after the retrieval request completes.
Therefore, you want to retrieve only portions of the archive so that you
can manage the schedule of downloads within the given download
window.
• Retrieve a targeted part of a large archive: For example, suppose you
have previously aggregated many files and uploaded them as a single
archive, and now you want to retrieve a few of the files. In this case, you
can specify a range of the archive that contains the files you are interested
in by using one retrieval request or you can initiate multiple retrieval
requests, each with a range for one or more files.
When initiating a retrieval job using range retrievals, you must provide a
range that is megabyte aligned. In other words, the byte range can start at
zero (the beginning of your archive), or at any 1 MB interval thereafter (1
MB, 2 MB, 3 MB, and so on).
8.13. S3 Bucket Lifecycle Policies

You can use lifecycle policies to define actions you want Amazon S3 to take
during an object's lifetime. For example, transition objects to another storage
class, archive them or delete them after a specified period of time.
You can define a lifecycle policy for all objects or a subset of objects in the bucket
by using a shared prefix (that is, objects that have names that begin with a
common string).
15
A versioning-enabled bucket can have many versions of the same object, one
current version and zero or more non-current (previous) versions. Using a
lifecycle policy, you can define the actions specific to current and non-current
object versions.
Object Lifecycle Management
You can configure the lifecycle to manage your objects so that they are stored
cost effectively throughout their lifecycle. A lifecycle configuration is a set of rules
that define the actions that Amazon S3 applies to a group of objects.
There are two types of actions, namely:
• Transition actions:
Define when objects transition to another storage class. For example, you
might choose to transition objects to the Standard_IA storage class for 30
days after you created them, or archive objects to the Glacier storage class
for one year after creating them.
• Expiration actions:
Define when objects expire. Amazon S3 deletes expired objects on your
behalf.
8.14. S3 Server Side Encryption (SSE)

Server-side encryption is about data encryption at rest that is, Amazon S3
encrypts your data at the object level as it writes it to disks in its data centers
and decrypts it for you when you access it. As long as you authenticate your
request and you have access permissions, there is no difference in the way you
access encrypted or unencrypted objects. For example, if you share your objects
using a pre-signed URL, that URL works the same way for both encrypted and
unencrypted objects.
Note:
You can't apply different types of server-side encryption to the same object
simultaneously.
You have three mutually exclusive options depending on how you choose to
manage the encryption keys:
• Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3):
Each object is encrypted with a unique key employing strong multi-factor
encryption. As an additional safeguard, it encrypts the key itself with a
master key that regularly rotates. Amazon S3 server-side encryption uses
one of the strongest block ciphers available, 256-bit Advanced Encryption
Standard (AES-256), to encrypt your data.
• Encryption with AWS KMS-Managed Keys (SSE-KMS):
Similar to SSE-S3, but with some additional benefits along with some
additional charges for using this service. There are separate permissions
16
for the use of an envelope key (that is, a key that protects your data's
encryption key) that provides added protection against unauthorized
access of your objects in S3. SSE-KMS also provides you with an audit
trail of when your key was used and by whom. Additionally, you have
the option to create and manage encryption keys by yourself, or use a
default key that is unique for the service you are using, and the region
you are working in.
• Use Server-Side Encryption with Customer-Provided Keys (SSE-C):
You manage the encryption keys and Amazon S3 manages the encryption
as it writes to disks and decryption when you access your objects. When
you list objects in your bucket, the list API will return a list of all objects
regardless of whether they are encrypted.
8.15. S3: Static Website Hosting in an S3 Bucket

You can host a static website on Amazon Simple Storage Service (Amazon S3).
On a static website, individual webpages include static content. They might also
contain client-side scripts. By contrast, a dynamic website relies on server-side
processing, including server-side scripts such as PHP, JSP, or ASP.NET. Amazon
S3 does not support server-side scripting. Amazon Web Services (AWS) also has
resources for hosting dynamic websites.
To enable website hosting for an Amazon S3 bucket:
1. Sign in to the AWS Management Console and open the Amazon S3
console.
2. Select the bucket in the list that you want to use for your hosted website.
3. Click Properties tab.
4. Click Static website hosting, and then select Use this bucket to host a
website.
5. You are prompted to provide the index document and any optional error
documents and redirection rules that are needed.
8.16. S3: Pre-Signed URLs

A pre-signed URL gives you the access to the object identified in the URL,
provided that the creator of the pre-signed URL has permissions to access that
object. That is, if you receive a pre-signed URL to upload an object, you can
upload the object only if the creator of the pre-signed URL has the necessary
permissions to upload that object.
By default, all objects and buckets are private. The pre-signed URLs are useful if
you want your user or customer to be able to upload a specific object to your
bucket, but you don't require them to have AWS security credentials or
permissions. When you create a pre-signed URL, you must provide your
security credentials and then specify a bucket name, an object key, an HTTP
17
method (PUT for uploading objects), and an expiration date and time. The pre-
signed URLs are valid only for the specified duration.
You can generate a pre-signed URL programmatically using the AWS SDK for
Java or the AWS SDK for .NET. If you are using Microsoft Visual Studio, you
can also use AWS Explorer to generate a pre-signed object URL without writing
any code. Anyone who receives a valid pre-signed URL can then
programmatically upload an object.
8.17. S3: Cross Region Replication (CRR)

Cross-region replication is a bucket-level configuration that enables automatic,
asynchronous copying of objects across buckets in different AWS regions. These
buckets are referred as source bucket and destination bucket. These buckets can be
owned by different AWS accounts.
To activate this feature, you can add a replication configuration to your source
bucket to direct Amazon S3 to replicate objects according to the configuration. In
the replication configuration, you provide the following information:
• The destination bucket where you want Amazon S3 to replicate the
objects.
• The objects you want to replicate. You can request Amazon S3 to replicate
all or a subset of objects by providing a key name prefix in the
configuration. For example, you can configure cross-region replication to
replicate only objects with the key name prefix Tax/. This causes Amazon
S3 to replicate objects with a key such as Tax/doc1 or Tax/doc2, but not an
object with the key Legal/doc3.
• By default, Amazon S3 uses the storage class of the source object to create
an object replica. You can optionally specify a storage class to use for
object replicas in the destination bucket.
Unless you make specific requests in the replication configuration, the object
replicas in the destination bucket are exact replicas of the objects in the source
bucket.
For example:
• Replicas have the same key names and the same metadata such as
creation time, user-defined metadata, and version ID.
• Amazon S3 stores object replicas using the same storage class as the
source object, unless you explicitly specify a different storage class in the
replication configuration.
• Assuming that the object replica continues to be owned by the source
object owner, when Amazon S3 initially replicates objects, it also
replicates the corresponding object Access Control List (ACL).
18
Amazon S3 encrypts all data in transit across AWS regions using Secure Sockets
Layer (SSL).
You can replicate objects from a source bucket to only one destination bucket.
After Amazon S3 replicates an object, the object cannot be replicated again. For
example, you might change the destination bucket in an existing replication
configuration, but Amazon S3 does not replicate it again.
Use case Scenarios
You might configure cross-region replication on a bucket for various reasons,

including the following:
• Compliance requirements: Although, by default, Amazon S3 stores your
data across multiple geographically distant Availability Zones,
compliance requirements might dictate that you store data at even further
distances. Cross-region replication allows you to replicate data between
distant AWS regions to satisfy these compliance requirements.
• Minimize latency: Your customers are in two geographic locations. To
minimize latency in accessing objects, you can maintain object copies in
AWS regions that are geographically closer to your users.
• Operational reasons: You have compute clusters in two different AWS
regions that analyze the same set of objects. You might choose to
maintain object copies in those regions.
• Maintain object copies under different ownership: Regardless of who
owns the source bucket or the source object, you can direct Amazon S3 to
change replica ownership to the AWS account that owns the destination
bucket. You might choose to do this to restrict access to object replicas.
This is also referred to as the owner override option of the replication
configuration.
8.18. S3: Transfer Acceleration

Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files
over long distances between your client and an S3 bucket. Transfer Acceleration
takes advantage of Amazon CloudFront’s globally distributed edge locations. As
the data arrives at an edge location, data is routed to Amazon S3 over an
optimized network path.
Why Use Amazon S3 Transfer Acceleration?
You want to use Transfer Acceleration on a bucket for various reasons,
including the following:
• You have customers who upload to a centralized bucket from all over the
world.
• You transfer gigabytes to terabytes of data on a regular basis across
continents.
19
• You underutilize the available bandwidth over the Internet when

uploading to Amazon S3.
8.19. S3: Performance Considerations

Amazon S3 scales to support very high request rates. If your request rate grows
steadily, Amazon S3 automatically partitions your buckets as needed to support
higher request rates. However, if you expect a rapid increase in the request rate
for a bucket to more than 300 PUT/LIST/DELETE requests per second or more
than 800 GET requests per second, it is recommended to open a support case to
prepare for the workload and avoid any temporary limits on your request rate.
Note:
The Amazon S3 best practice guidelines in this topic apply only if you are
routinely processing 100 or more requests per second. If your typical workload
involves only occasional bursts of 100 requests per second and fewer than 800
requests per second, you don't need to follow these guidelines.
The Amazon S3 best practice guidance given in this topic is based on two types
of workloads:
• Workloads that include a mix of request types: If your requests are
typically a mix of GET, PUT, DELETE, or GET Bucket (list objects),
choosing appropriate key names for your objects ensure better
performance by providing low-latency access to the Amazon S3 index. It
also ensures scalability regardless of the number of requests you send per
second.
• Workloads that are GET-intensive: If the bulk of your workload consists
of GET requests, it is recommended to use the Amazon CloudFront
content delivery service.
8.20. S3: Billing

When using Amazon Simple Storage Service (Amazon S3), you don't have to
pay any upfront fees or commit to how much content you will store. Similar to
other Amazon Web Services (AWS) service, you pay as you go and pay only for
what you use.
AWS provides the following reports for Amazon S3:
• Billing reports: Multiple reports that provide high-level views of all the
activity for the AWS services that you are using, including Amazon S3.
AWS always bills the owner of the S3 bucket for Amazon S3 fees unless
the bucket was created as a Requester Pays bucket.
• Usage report: A summary of activity for a specific service, aggregated by
hour, day, or month. You can choose which usage type and operation to
include. You can also choose how the data is aggregate.
20
8.21. S3: Notification

Amazon S3 supports the following destinations where it can publish events:
• Amazon Simple Notification Service (Amazon SNS)
Amazon SNS is a flexible, fully managed push messaging service. Using
this service, you can push messages to mobile devices or distributed
services. With SNS, you can publish a message once and deliver it one or
more times. An SNS topic is an access point that recipients can
dynamically subscribe in order to receive the event notifications.
• Amazon Simple Queue Service (Amazon SQS) queue
Amazon SQS is a scalable and fully managed message queuing service.
You can use SQS to transmit any volume of data without requiring other
services to be always available. In your notification configuration you can
request that Amazon S3 publish events to an SQS queue.
• AWS Lambda
AWS Lambda is a compute service that makes it easy for you to build
applications that respond quickly to new information. AWS Lambda runs
your code in response to events such as image uploads, in-app activity,
website clicks, or outputs from connected devices. You can use AWS
Lambda to extend other AWS services with custom logic, or create your
own back-end that operates at AWS scale, performance, and security.
With AWS Lambda, you can easily create discrete, event-driven
applications that execute only when needed and scale automatically from
a few requests per day to thousands per second.
AWS Lambda can run custom code in response to Amazon S3 bucket
events. You upload your custom code to AWS Lambda and create a
Lambda function. When Amazon S3 detects an event of a specific type
(for example, an object created event), it can publish the event to AWS
Lambda and invoke your function in Lambda. In response, AWS Lambda
executes your function.
8.22. S3: Monitoring

AWS provides various tools that can be used to monitor Amazon S3. You can
configure some of these tools to perform monitoring for you, while some of the
tools require manual intervention. It is recommended to automate monitoring
tasks as much as possible.
21
Automated Monitoring Tools

You can use the following automated monitoring tools to watch Amazon S3 and
report when something is wrong:
• Amazon CloudWatch Alarms: Watch a single metric over a time period
that you specify and perform one or more actions based on the value of
the metric relative to a given threshold over a number of time periods.
The action is a notification sent to an Amazon Simple Notification Service
(Amazon SNS) topic or Amazon EC2 Auto Scaling policy. CloudWatch
alarms do not invoke actions simply because they are in a particular state;
the state must have changed and been maintained for a specified number
of periods.
• AWS CloudTrail Log Monitoring: Share log files between accounts,
monitor CloudTrail log files in real time by sending them to CloudWatch
Logs, write log processing applications in Java, and validate that your log
files have not changed after delivery by CloudTrail.
22
Summary
• Amazon S3 is object storage built to store and retrieve any amount of data
from anywhere such as web sites and mobile apps, corporate
applications, and data from IoT sensors or devices.
• Amazon S3 is designed to deliver 99.999999999% durability, and stores
data for millions of applications used by market leaders in every
industry.
• Amazon S3 provides comprehensive security and compliance capabilities
that meet even the most stringent regulatory requirements.
• Amazon S3 gives customers flexibility in the way they manage data for
cost optimization, access control, and compliance.
• Amazon S3 provides query-in-place functionality, allowing you to run
powerful analytics directly on your data at rest.
• Amazon S3 is the most supported Cloud storage service available, with
integration from the largest community of third-party solutions, systems
integrator partners, and other AWS services.
23
References:
1. http://docs.aws.amazon.com/*
2. https://aws.amazon.com/whitepapers/*
3. https://aws.amazon.com/blogs/*
24

AWS - Module 8 - Simple Storage Services - RM - Final

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

AWS - Module 8 - Simple Storage Services - RM - Final

Uploaded by

Copyright:

Available Formats

AWS Foundation and Architecture

Module 8: Simple Storage Services

Upon completion of this module, you will be able to:

8.1. Introduction to Object Storage

8.2. S3: Data Consistency Models in Distributed Storage Systems

8.3. AWS S3 Buckets

8.5. S3 Managing Access and Access Policies

8.6. AWS S3 Access Policy types

8.7. S3: Understanding Bucket and Object ACLs: Closer Look

When to use Access Control Lists with Buckets and Object

8.8. Bucket Versioning (S3 Bucket Sub-resource)

Versioning-enabled buckets help you to recover objects from accidental deletion

8.9. S3: Copying or Uploading S3 Objects

8.10. S3: Storage Tiers or Classes

• S3 Standard IA (Infrequent Access) storage class is optimized for long-

• Designed for 99.9% availability over a given year.

decades. Amazon Glacier enables the customers to offload the administrative

8.12. Glacier: Archive Retrieval in Glacier

8.13. S3 Bucket Lifecycle Policies

8.14. S3 Server Side Encryption (SSE)

8.15. S3: Static Website Hosting in an S3 Bucket

8.16. S3: Pre-Signed URLs

8.17. S3: Cross Region Replication (CRR)

You might configure cross-region replication on a bucket for various reasons,

8.18. S3: Transfer Acceleration

• You underutilize the available bandwidth over the Internet when

8.19. S3: Performance Considerations

8.20. S3: Billing

8.21. S3: Notification

8.22. S3: Monitoring

Automated Monitoring Tools

You might also like