# SAA - C03 Certification: S3

## Security

* User-based
    
    * IAM policies
        
* Resource-based
    
    * Bucket policies
        
    * Object/Bucket ACL (can be disabled)
        

### Bucket Policies

* JSON-based policies
    
    * Resources: buckets and objects
        
    * Effect: Allow / Deny
        
    * Actions: Set of APIs to Allow or Deny
        
    * Principal: The account or user to apply the policy to
        

## Replication

* Must enable Versioning in source and destination buckets
    
* Cross-Region Replication (CRR)
    
* Same-Region Replication (SRR)
    
* Buckets can be in different AWS accounts
    
* Copying is asynchronous
    
* Must give proper IAM permissions to S3
    

Use cases:

* CRR: lower latency access, replication across accounts
    
* SRR: log aggregation, live replication between production and test accounts
    

Some notes:

* After you enable Replication, only new objects are replicated
    
* Optionally, you can replicate existing objects using **S3 Batch Replication**
    
* For DELETE operations:
    
    * Can replicate delete markers from source to target (optional setting)
        
    * Deletions with a version ID are not replicated (to avoid malicious deletes)
        
* **There is no "chaining" of replication**
    

### Storage Class

* Standard - General Purpose - 99.99% (Big Data, Mobile & Gaming, Content Distribution,...)
    
* Standard - Infrequent Access (IA) - 99.9% (Disaster Recovery, backups)
    
* One Zone - Infrequent Access - 99.5% (Storing secondary backup)
    
* Glacier Instant Retrieval
    
    * Millisecond retrieval, is great for data accessed once a quarter
        
    * Minimum storage duration of 90 days
        
* Glacier Flexible Retrieval
    
    * Expedited (1 to 5 minutes), Standard (3 to 5 hours), Bulk (5 to 12 hours) - free
        
    * Minimum storage duration of 90 days
        
* Glacier Deep Archive - for long-term storage
    
    * Standard (12 hours), Bulk (48 hours)
        
* Intelligent Tiering
    * Small monthly monitoring and auro-tiering free
    * Moves object automatically between Access Tiers based on usage
    * There are no retrieval charges in S3 Intelligent-Tiering
    * Frequent Access tier (auto): default tier
    * Infrequent Access tier (auto): objects not accessed for 30 days
    * Archive Instant Access tier (auto): objects not accessed for 90 days
    * Archive Access tier (optional): configurable from 90 days to 700+ days
    * Deep Archive Access tier (optional): configurable from 180 days to 700+ days

Lifecycle Rules

- Transition Actions: configure objects to transition to another storage class
- Expiration Actions: configure objects to expire (delete) after some time
- Rules can be created for **a certain prefix** (ex: s3://bucket/mp3/*)
- Rules can be created for **certain object tags**

Performance

- Latency 100 - 200ms
- Your application can achieve at least 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix in a bucket
- There are no limits to the number of prefixes in a bucket
- If you spread reads across all 4 prefixes evenly, you can achieve 22,00 RPS for GET/HEAD
- Multi-part upload:
  + recommend for files > 100 MB, must use for files > 5 GB
  + can help parallelize upload (speed up transfers)
- Byte-range fetches
  + Parallelize GETs by requesting specific byte ranges
  + Better resilience in case of failures
  + Can be used to speed up downloads

### Object Encryption

- Server-side encryption (SSE)
  + SSE with Amazon S3-Managed Keys (SSE-S3) - enable by default (AES-256)
  + SSE with KMS Keys stored in AWS KMS (SSE-KMS) - Needing to make an API call to KMS to receive an encryption key **(5500, 10000, 3000 req/s based on region)**
    + Can request a quota increase using the **Service Quotas Console**
  + SSE with customer-provided keys (SSE-C) (Only support **HTTPS**)
- Client-side encryption

### S3 Glacier Vault Lock

- Adopt a WORM (write once and read many)
- Create a Vault Lock Policy
- Helpful for compliance and data retention

### S3 Object Lock (versioning must be enabled)

- Adopt a WORM (write once and read many)
- Block an object version deletion for a specified amount of time

### S3 - Access Points

- Each access point has:
  + its own DNS name (Internet Origin or VPC Origin)

VPC Origin

- We can define the access point to be accessible only from within the VPC
- You must create a VPC Endpoint to access the access endpoint (Gateway or Interface Endpoint)
- The VPC endpoint policy must allow access to the target bucket and Access Point