it can help you prevent objects from being deleted or modified for a fixed amount of time or indefinitely

can use to meet regulator requirements that require WORM storage or add an extra layer of protection against object changes and deletion

⭐ Users can't overwrite or delete an object version or alter its lock settings unless they have special permissions

protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings ore delete the object if necessary

⭐ a protected object version can't be overwritten or delete by any user, including the root uses in your AWS account.

When an object is locked in compliance mode, its retention mode can't be changed and its retention period can't be shortened.

Compliance mode ensures an object version can't be overwritten or deleted for the duration of retention period

protects an object version for a fixed amount of time. When you place a retention period on an object version, Amazon S3 stores a timestamp in the object version's metadata to indicate when the retention period expires

After the retention period expires, the object version can be overwritten or deleted unless you also placed a legal hold on the object version

S3 Object Lock also enables you to place a legal hold on a object version

Like a retention period, a legal hold prevents an object version from being overwritten or deleted

However, a legal hold doesn't have an associated retention period and remains in effect until removed. Legal holds can be freely placed and removed by any user who has the s3:PutObjectLegalHold permission

S3 has extremely low latency. You can get the first byte of S3 within 100 - 200 ms

3,500 PUT/COPY/POST/DELETE

3,500 PUT/COPY/POST/DELETE

EX: if you are using two prefixes, you can achieve 11,000 request per second

Uploading/downloading will count to toward the KMS quota

Region specific, however it's either 5,500, 10,00 or 30,000 requests per second

Use multipart uploads to increase performance when uploading files to S3

should be used for any files over 100 MB and must be used for any file over 5 GB

Use S3 byte-range fetches to increase performance when downloading files to S3

enables application to retrieve only a subset of data from an object by using simple SQL expression

By using S3 Select to retrieve only the data needed by your application, you can achieve drastic performance increase in many cases, you can get as much as a 400% improvement

Remember that S3 Select is used to retrieve only a subset of data from an object by using simple SQL expressions

Get data by Rows or Columns using simple SQL expressions

AWS Organizations is an account management service that enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage

Paying account should be used for billing purpose only. Do not deploy resources into the paying account

Enable/Disable AWS services using Service Control Polices (SCP) either on OU or on individual accounts

Using Bucket Policies $ IAM ( applies across the entire bucket). Programmatic Access Only

Using Bucket ACLs & IAM ( individual objects). Programmatic Access Only

Cross-account IAM Roles. Programmatic AND Console access

Versioning must be enabled on both the source and destination buckets

Files in an existing bucket are not replicated automatically

All subsequent updated files will be replicated automatically

Deleting individual versions or delete markers will not be replicated

Understand what Cross Region Replication is at a high level

Utilises the CloudFront Edge Network to accelerate your uploads to S3

Instead of uploading directly to your S3 bucket, you can use a distinct URL to upload directly to an edge location which will then transfer that file to S3. You will get a distinct URL to upload to : abc.s3-accelerate.amazonaws.com

Used to move large amounts of data from on-premises to AWS

Used with NFS and SMB compatible file systems

Replication can be done hourly, daily, or weekly

Install the DataSync agent to start the replication

A content delivery network (CDN) is a system of distributed servers (network) that deliver webpages and other web content to a user based on the geographic locations of the user, the origin of the webpage, and a content delivery server

can be used to deliver you entire website, including dynamic, static, streaming, and interactive content using a global network of edge locations. Requests for your content are automatically routed to the nearest edge location, so content is delivered with the best possible performance

Trusted signers (which AWS accounts can create signed URLs

Stores all versions of an object (including all writes and even if you delete an object)

Once enabled, Versioning cannot be disabled, only suspended

Automates moving your objects between the different storage tiers

can be configured to create access logs which log all request made to the S3 bucket

This can be sent to another bucket and even another bucket in another account

is as service that connects an on-premises software appliance with cloud-based storage to provide seamless and secure integration between an organization's on-premises IT environment and AWS's storage infrastructure. The service enables you to securely store data to the AWS cloud for scalable and cost-effective storage

AWS Storage Gateways software appliance is available for download as a virtual machine (VM) image that you install on a host in your datacenter. Storage Gateway supports either VMware ESXi or Microsoft Heyper-V. Once you've installed your gateway and associated it with your AWS account through the activation process, you can use the AWS Management Console to create the storage gateway option that is right for you

Entire Dataset is stored on site and is asynchronously backed up to S3

Entire Dataset is stored on S3 and the most frequently accessed data is cached on site

Serverless, nothing to provision, pay per query / per TB scanned

No need to set up complex Extract/Transform/Load (ETL) process

Can bed used to query log files stored in S3, e.g. ELB logs, S3 access logs etc

The *"root account" is simply the account created when first setup your AWS account. It has complete Admin access

New Users are assigned Access Key ID & Secret Access Keys when first created

These are not the same as a password. You cannot use the Access key ID & Secret Access Key to Login in to the console. You can use this to access AWS via the APIs and Command line, however

You only get to view these once. If you lose them, you have to regenerate them. So, save them in a secure location.

Always setup Multifactor Authentication on your root account

You can create and customize your own password rotation policies

is Amazon S3's lowest-cost storage class where a retrieval time of 12 hours is acceptable

can reliably store any amount for data at costs that are competitive with or cheaper than on-premises configurable from minutes to hours

for data that is accessed less frequently, but requires rapid access when needed

Identity Federation (Active Directory, Facebook, Linked ...)

Provide temporary access for users/devices and Service where necessary