Same as IA, however data is stored in a single AZ only
S3 - Reduced Redundancy Storage
Data that is easily reproducible such as thumbnails, etc
Glacier
Archived data, where you can wait 3-5 hours before accessing
Core Fundamentals of an S3 Object:
Key (name)
Value (data)
Version ID
Metadata
Subresources (used to manage bucket-specific configuration)
Bucket Policies, ACLs
Control access to buckets and content
CORS
Cross Origin Resource Sharing
Allow one resource to access another resource
Transfer Acceleration
Object storage only (for files)
Not suitable to install an OS
Successful uploads will generate an HTTP 200 status code
By default, all newly created buckets are private
You can set up access control to your buckets using:
Bucket policies - applied at bucket level
ACLs - applied at an object level
S3 buckets can be configured to create access logs, which log all requests made to the S3 bucket
These logs can be written to another bucket
S3 Encryption
Encryption In-Transit
SSL/TLS
Any request made into S3 is encrypted in transit or on the network
Make request into the bucket using HTTPS
Encryption At Rest
Server Side Encryption
SSE-S3
Each object is encrypted using a unique key with strong multifactor encryption
Keys are managed within S3
Managed by AWS end to end
Advanced encryption standard 256 bit
SSE-KMS
Separate permissions for an envelope key
Protects data’s encryption key
Audit trail telling you when keys were used and by who
SSE-C
Customer provided key
You manage your own key
AWS encrypts and decrypts
Client Side Encryption
Encrypt it before you upload to S3
Remember that we can use a bucket policy to prevent unencrypted files from being uploaded by creating a policy which only allows requests which include the x-amz-server-side-encryption parameter in the request header
CORS-Summary
Cross Origin Resource Sharing (CORS)
Used to enable cross origin access for your AWS resources
E.g. S3 hosted website accessing javascript or image files located in another S3 bucket
By default resources in one bucket cannot access resources located in another
To allow this we need to configure CORS on the bucket being accessed and enable access for the origin (bucket) attempting to access
Always use the s3 website URL, not the regular bucket URL