Simple Storage Service

  • Global Storage Platform
  • Private by default
    • Only root user has access by default
  • Region Based - Data is stored in a specific region
  • Regionally resilient - Data is replicated across AZs in the regions
  • Public Service running from AWS Public Zone

Components

  • Objects
    • Like files
    • Made of object key, object value and some metadata
    • Min size: 0 bytes to Max size: 5TB
  • Buckets
    • Containers for objects
    • Created in specific region
      • Data inside the bucket never leaves the region
      • Blast Radius = Region
    • Bucket name needs to be globally unique
    • Can store unlimited number of objects - Infinitely scalable storage system
    • There is no concept of file type. Everything is the object key including the file type extension
    • Names should be 3-63 characters
      • Cant be formatted as IP addresses
    • 100 soft limit, 1000 hard limit per account
  • Flat Structure
    • Everything is stored in the bucket at the root level
    • When the key has / S3 presents this as a folder structure. Folders are referred to as prefixes in S3
  • Not a file or block storage
  • Cant mount a S3 buckets
  • All buckets are private by default

Security

Bucket Policy

  • Type of Resource Policy
    • A resource policy is like identity policy but is attached to resources instead of identities
    • Unlike identity policies which can only provide access to identities inside the current account, resource policies can provide access to identities on the same account or different accounts as well
    • Resource policies can also be attached to anonymous principals
    • Identity policies control permissions from an identity perspective and the resource policy is from a resource perspective
  • One bucket policy allowed per bucket
    • A single policy can contain multiple statements
  • When an identity inside an account tries to access a bucket inside the same account, then the final policy is a combinaiton of identity policy & the bucket policy
  • When an identity outside an account tries to access a bucket inside the same account, then the final policy is a combinaiton of that identity's policy & the bucket policy
    • The identitiy's policy should still be able to access the bucket in S3
  • When an anonymous identity tries to access a bucket inside the account, then the final policy is just the bucket policy

ACLs

  • Legacy concept
  • Inflexible & Simple permissions ACL Conditions

Block Public Access

  • Applies only to anonymous principles
  • Does not apply to identities Block Public Access

Object Storage Classes

Standard

Standard - Infrequent Access

One Zone IA

Glacier - Instant Retrieval

Glacier - Flexible

Glacier - Deep Archive

Intelligent Tiering

S3 Static Website Hosting

Pricing

Object Versioning

MFA Delete

Performance Optimization

Multipart Upload

Accelerated Transfer

Labs

Bucket Policy

Static Website Hosting

Versioning

Performance Optimization

Storage Classes