S3 101

Question 1

What does S3 stand for?

Answer 1

Simple Storage Service

Question 2

What is S3 used for?

Answer 2

• S3 provides developers + IT teams w/ secure, durable, highly-scalable object storage.
• retrieve and store any amount of data from anywhere on the web

Question 3

What type of storage does S3 use?

Answer 3

S3 uses Object-based storage – i.e. allows you to upload files

Question 4

What is the maximum allowable storage you can have in S3 for a single object?

Answer 4

• S3 files can be from 0 Bytes to 5 TB.

Question 5

What is the maximum allowable storage you can have in S3 in total?

Answer 5

The total volume of data and number of objects you can store are unlimited

_{(Source: https://aws.amazon.com/s3/faqs/)}

Question 6

What are S3 buckets? What are they used for?

Answer 6

S3 buckets store files. (Think of them like a file folder)

Question 7

What type of namespace does S3 use?

Answer 7

S3 uses a universal namespace.

That is, names must be globally unique.

Question 8

You go in to the AWS console and want to make a bucket called testbucket in the Japanese region. Why won’t AWS let you do this?

Answer 8

Bucket names are global, not regional.

testbucket is a common name and has already been taken by someone else

Question 9

When you successfully upload a file to S3, what will you receive back?

Answer 9

an HTTP 200 code

Question 10

What are the components of an S3 object? What do each of these components represent?

Answer 10

An S3 object consists of the following:

• Key (The name of the object)
• Value (the data, made up of a sequence of bytes)
• Version ID (Important for versioning/version control)
• Metadata (data about data you are storing)
• Subresources (Access Control Lists, Torrent)

Question 11

What is the data consistency model in S3?

Answer 11

• Read After Write Consistency (Strong Consistency) for everything

_{(Updated as of Dec 2020)}

Question 12

For what % availability was the S3 platform built?

Answer 12

99.99%

Question 13

What % availability does Amazon guarantee for S3 Standard?

Answer 13

99.9%

Question 14

What % durability does Amazon guarantee for all S3 storage classes?

Answer 14

99.999999999% durability (11 9’s)

Question 15

What is the availability of S3-OneZone-IA?

Answer 15

99.50%

Question 16

What are the key features of S3?

Answer 16

• Versioning
• MFA Delete
• Encryption
• Lifecycle Management
• Tiered Storage
• Secure Data using Access Control Lists and Bucket Policies

_{(try the acronym V MELTS)}

Question 17

What are the key features of S3 Standard?

Answer 17

• 99.99% Avail
• 11 9’s Durability
• Redundancy Stored redundantly across multiple devices in multiple facilities,
• designed to sustain the loss of 2 facilities concurrently

Question 18

What does the “IA” stand for in S3-IA?

Answer 18

Infrequently Accessed

Question 19

What type of data is best stored in S3-IA?

Answer 19

S3-IA is best for data that is not accessed frequently, but requires rapid access when needed

Question 20

What is the pricing structure of S3-IA? Specifically, how does it differ from that of S3 Standard?

Answer 20

• S3-IA has a lower base storage fee than S3 Standard.
• However, S3-IA charges a retrieval fee.

Question 21

What are the key differences between S3-IA and S3 One Zone - IA?

Answer 21

Compared to S3-IA, S3 One Zone- IA has lower cost but less durability.

• S3 One Zone-IA is a lower-cost option for IA data
• S3 One Zone-IA does not give the multiple Availability Zone resilience of S3 Standard and S3 IA.

Question 22

What is S3 - Intelligent Tiering?

Answer 22

S3 Intelligent tiering uses ML and is designed to optimize costs by automatically moving data to the most cost-effective access tier, without performance impact or operational overhead. (Basically, it’s the autopilot mode for S3 tiering)

Question 23

How does the pricing model work for S3 Intelligent Tiering

Answer 23

Very similar to S3 Standard EXCEPT

• you have access to IA which is less expensive
• There is a monitoring / automation cost per thousand objects per month

Question 24

What is S3 Glacier primarily used for?

Answer 24

S3 Glacier is mostly used for data archival at low-cost

Question 25

How long does it take to retrieve something from S3 Glacier?

Answer 25

Retrieval times from S3 Glacier are **configurable** and **range from minutes to hours**

Question 26

What is **S3 Glacier Deep Archive**?

Answer 26

S3 Glacier Deep Archive is **S3's lowest-cost storage class**

Question 27

How long does it take to retrieve something from S3 Glacier Deep Archive?

Answer 27

S3 Glacier Deep Archive is for cases where a retrieval time of **12 hours is acceptable.**

Question 28

What are the areas on which you are charged for using S3?

Answer 28

* **Storage** (amount you are storing) * **Requests** * **Storage Management Pricing** (Tier) * **Data Transfer** * **Transfer Acceleration** * **Cross - Region Replication**

Question 29

What is **Transfer Acceleration**?

Answer 29

* Used for fast, easy, secure **transfers over long distances** between _end user_ and an _S3 bucket_ * Uses CloudFront's globally distributed edge locations: as data arrives at an edge location, data is routed to S3 over an optimized network path

Question 30

What is the format of the DNS name created for an S3 bucket in a specific region?

Answer 30

"http://s3.*aws-region*.amazonaws.com/*bucketName*" OR "http://*bucketname.*s3.*aws-region*.amazonaws.com" _{(https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)}

Question 31

How do you install an operating system on S3?

Answer 31

**You can't** S3 is NOT suitable to install an operating system on.

Question 32

How can I help, at a bucket-configuration level, to protect against someone going in and deleting data from S3?

Answer 32

Turn on **MFA Delete**

Question 33

What are the default access control permissions for newly created buckets?

Answer 33

By default, all newly created buckets are **private**

Question 34

How can I set up my S3 bucket to log all requests made to it?

Answer 34

S3 buckets can be configured to create *access logs*, which log all requests made to the S3 bucket.

Question 35

Can S3 access logs be stored in a different bucket?

Answer 35

**Yes**. S3 Access logs sent to another bucket or even another bucket in another account.

Question 36

In the context of S3, what does **CRR** stand for?

Answer 36

**C**ross-**R**egion **R**eplication

Question 37

Does Cross-Region Replication require bucket versioning?

Answer 37

**Yes.** Cross-region replication requires bucket versioning on **both the source and destination buckets**.

Question 38

When performing cross-region replication, what discrepancies will there be between the source and replication buckets?

Answer 38

* All **file (versions) made before CRR was turned on** are not automatically copied at creation * **Delete markers, deleted versions, and deletes of delete markers** are NOT replicated\* _{*this is still the default behavior, but as of Nov 2020, you can enable CRR for delete markers (https://aws.amazon.com/about-aws/whats-new/2020/11/amazon-s3-replication-adds-support-for-replicating-delete-markers/)}

Question 39

When performing cross-region replication, what *permissions* -- at the time of creation -- are different between the source bucket and the destination bucket?

Answer 39

by default, there are **NO** differences between the source and replicated buckets

Question 40

When performing cross-region replication, what *files* -- at the time of creation -- are different between the source bucket and the destination bucket?

Answer 40

When using cross-region replication, ***files in an existing bucket are NOT replicated automatically*.**

Question 41

At a high level, how does **S3 Transfer Acceleration** work?

Answer 41

Instead of uploading directly to a bucket, the **user** utilizes a **distinct (given) URL** to upload to an **edge location,** which *then* transfers through **Amazon Backbone** and directly uploads to an S3 bucket

Question 42

What is the general use case for **S3 Transfer Acceleration?**

Answer 42

**Accelerating uploads** to S3

Question 43

By default, is Transfer Acceleration enabled for a newly created S3 bucket?

Answer 43

**No**, by default, **transfer acceleration is suspended in newly-created S3 buckets**

Question 44

What S3 functionalities would you want to use for restricting content access?

Answer 44

**CloudFront Signed URLs and Cookies** and **S3 Signed URLs**

Question 45

What is the key difference between a **CloudFront Signed URL** and a **CloudFront Signed Cookie**?

Answer 45

* A signed URL is for individual files (1 file = 1 URL) * A signed cookie is for multiple files (1 cookie = multiple URLs)

Question 46

What can be included in the policy attached to a signed URL or signed cookie?

Answer 46

* URL expiration (how long it is valid) * IP ranges * Trusted Signers (which AWS accounts can create signed URLs)

Question 47

Can signed cookies handle RTMP distributions?

Answer 47

**No**

Question 48

What does **OAI** stand for?

Answer 48

Origin Access Identity

Question 49

Describe the process by which you get a CloudFront Signed URL

Answer 49

1. Client Authenticates and Authorizes to log in to the application 2. Application Uses CloudFront SDK to generate signed URL 3. Application Returns Signed URL to client 4. Client logs into Cloudfront using signed URL

Question 50

Can you use S3 Signed Cookies if your origin is in EC2?

Answer 50

**No**. If your origin is EC2, use CloudFront

Question 51

Can signed URLs handle RTMP distributions?

Answer 51

**Yes**

Question 52

What is **Amazon Snowball** used for?

Answer 52

BIG data Transfers into and out of AWS, including importing to and exporting from S3

Question 53

What is **Amazon Athena?** What is it commonly used for?

Answer 53

* Athena is an **interactive query service** that allows you to **query data located in S3 using SQL** * Commonly used to **analyse log data stored in S3**

Question 54

Is Amazon Athena Serverless?

Answer 54

**Yes**

Question 55

What does **PII** stand for?

Answer 55

Personally Identifiable Information

Question 56

What is **Amazon Macie**?

Answer 56

* Macie is a **security service** which **uses ML and NLP** to **discover, classify, and protect sensitive data used in S3** * Can be used to analyze CloudTrail logs for suspicious API activity * Includes Dashboards, Alerts, Monitoring * Great for PCI-DSS complicance and preventing Identity Theft

Question 57

How many S3 buckets can I have per account by default?

Answer 57

100

Question 58

How can I restore a file if I went to "Actions -\> Delete" on it in S3?

Answer 58

**Delete the delete marker**

Question 59

By default, are items automatically encrypted when they are stored in S3?

Answer 59

**No**, **Default encryption is NOT enabled by default**

Question 60

When creating a new S3 bucket, what bucket policies does it have by default?

Answer 60

**None.** By default, bucket policy does not exist for newly created S3 buckets

Question 61

By default, is versioning enabled for newly created S3 buckets?

Answer 61

**No**

Question 62

What are the S3 bucket policies?

Answer 62

* Versioning * Server Access Logging * Static Website Hosting * Object-Level Logging * Tags * Transfer Acceleration * Events * Requester Pays _{(https://docs.aws.amazon.com/AmazonS3/latest/user-guide/view-bucket-properties.html)}

Question 63

When uploading objects, what prefix must all user-defined metadata have?

Answer 63

`**x-amz-meta-**`

Question 64

In the console, after enabling logging on a source bucket, what permission do you need to give the destination bucket to ensure that the logs can be written there?

Answer 64

**You don't have to do anything.** When you enable logging on a bucket, the console both enables logging on the source bucket and adds a grant in the target bucket's access control list (ACL) granting write permission to the Log Delivery group. _{(https://docs.aws.amazon.com/AmazonS3/latest/dev/enable-logging-console.html)}

Question 65

When editing Amazon S3 bucket permissions (policies and ACLs), to whom does the concept of the "**resource owner**" refer?

Answer 65

The "resource owner" refers to **the AWS account that creates Amazon S3 buckets and objects.**

Question 66

What is **Expedited Retrieval**?

Answer 66

* Offered in **Glacier Select** * Gets you your data in **1-5 minutes** * Costs about **$0.03 per GB retrieved**

Question 67

Does AWS automatically delete incomplete multi-part uploads?

Answer 67

**No**

Question 68

Does S3 allow for chaining of replications?

Answer 68

No

Question 69

What are the tiers of S3 Glacier?

Answer 69

They're all based around _retrieval time_ - Instant (millisecond retrieval, but min storage time of 90 days) - Flexible (min storage duration 90 days) - Deep archive (min storage duration 180 days)

Question 70

What is **S3 Replication Time Control** (RTC)?

Answer 70

A feature for Cross-Region or Same-Region Replication that ensures 99.99% of objects are replicated within 15 minutes and provides metrics to monitor this latency.

Question 71

What is the default encryption for new S3 objects if no encryption headers are provided in the upload request?

Answer 71

**SSE-S3** (Server-Side Encryption with S3 Managed Keys). | This is a recent change that enforces encryption by default.

Question 72

In a bucket policy, what does the `s3:GetObject` action allow?

Answer 72

It grants permission to read the contents of an object (download it).

Question 73

What is an **S3 Pre-Signed URL** and why is it used?

Answer 73

It is a URL generated by the AWS SDK/CLI that grants **temporary access** (read, write, or both) to a specific object **without requiring any AWS credentials**.

Question 74

What is the **principal** in an S3 Bucket Policy?

Answer 74

The entity (e.g., an IAM User, IAM Role, or another AWS Account) that is **being granted or denied permission** to access the bucket.