Please enable JavaScript.

Coggle requires JavaScript to display documents.

S3 Object Lock, S3・101, S3 Performance, Cross Region Replication, S3…

- - - - it can help you prevent objects from being deleted or modified for a fixed amount of time or indefinitely
  - - - :zap:
        
        :star: Users can't overwrite or delete an object version or alter its lock settings unless they have special permissions
      - :zap:
        
        protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings ore delete the object if necessary
  - - - :zap:
        
        :star: a protected object version can't be overwritten or delete by any user, including the root uses in your AWS account.
      - :zap:
        
        When an object is locked in compliance mode, its retention mode can't be changed and its retention period can't be shortened.
      - :zap:
        
        Compliance mode ensures an object version can't be overwritten or deleted for the duration of retention period
  - - - :zap:
        
        protects an object version for a fixed amount of time. When you place a retention period on an object version, Amazon S3 stores a timestamp in the object version's metadata to indicate when the retention period expires
      - :zap:
        
        After the retention period expires, the object version can be overwritten or deleted unless you also placed a legal hold on the object version
  - - - :zap:
        
        S3 Object Lock also enables you to place a legal hold on a object version
      - :zap:
        
        Like a retention period, a legal hold prevents an object version from being overwritten or deleted
      - :zap:
        
        However, a legal hold doesn't have an associated retention period and remains in effect until removed. Legal holds can be freely placed and removed by any user who has the s3:PutObjectLegalHold permission
- - - - Governance mode
      - compliance mode
- - - - https://yourcloud.eu-west-1.amazonaws.com
      - https://yourcloud.s3.amazonaws.com
  - - - names must be unique globally
  - - - allow you to upload files
        
        :zap:
        
        file can be
        
        5 TB
        
        0 bytes
        
        :zap:
        
        Files are stored in Buckets
        
        :zap:
        
        when upload file
        
        sucessfull
        
        200 code
    - - consist
        
        :zap:
        
        Sub resources
        
        Torrent
        
        Access Control List
        
        :zap:
        
        Metadata
        
        Data about data you are storing
        
        :zap:
        
        Version Id
        
        important for versioning
        
        :zap:
        
        Value
        
        made up of sequence of bytes
        
        simply the data
        
        :zap:
        
        Key
        
        name of the object
    - - Think of objects just as files
- - - - Built for 99.99% availability for the S3 platform
    - - Amazon Guarantee 99% availability
    - - Amazon guarantees 11x9s durability for S3 information
- - - - :star:Tiered Storage Available
    - - Lifecycle Management
    - - Versioning
    - - Encryption
    - - MFA Delete
    - - Secure your data
        
        :zap:
        
        Access Control List
        
        :zap:
        
        Bucket Policies
- - - - Read after Write consistency for PUTs of new Object
    - - Eventual Consistency for overwrite PUTS and DELETE
- - - - enables
        
        fast
        
        easy
        
        secure transfers of files over long distance between your end users and an S3 bucker
    - - takes advantage of Amazon Cloud Front's globally distributed edge location
        
        Data arrives at an edge location, data is routed to Amazon S3 over an optimized network path
- - - - Bucket Policies
        
        Applies across the whole bucket
    - - Object Polices
        
        Applies to individual files
    - - IAM Policies to Users&Groups
        
        Applies to Users & Groups
- - - - S3 Glacier Deep Archive
        
        is Amazon S3's lowest-cost storage class where a retrieval time of 12 hours is acceptable
    - - S3 Glacier
        
        can reliably store any amount for data at costs that are competitive with or cheaper than on-premises configurable from minutes to hours
        
        a secure, durable and low-cost storage class for data arching
    - - S3 Intelligent Tiering
        
        Designed to optimize cost by automatically moving data to the most cost-effective access tier
        
        without performance impact or operation overhead
    - - S3 One Zone - IA
        
        for where want a lower-cost option for infrequently accessed data
        
        not require the multiple Availability Zone data resilience
    - - S3 - IA
        
        :zap:
        
        Lower fee than S3
        
        but you are charged a retrieval fee
        
        :zap:
        
        for data that is accessed less frequently, but requires rapid access when needed
    - - S3 Standard
        
        :zap:
        
        is designed to sustain the loss of 2 facilities concurrently
        
        stored redundantly across multiple devices in multiple facilites
        
        99.99999999999% durability
        
        :zap:
        
        99.99% availability
- - - - ex: mybucketname/folder1/subfolder/myfile.jpg
        
        prefix: /folder1/subfolder1
  - - - 3,500 PUT/COPY/POST/DELETE
      - 5,500 GET/HEAD request per second per prefix
  - - - EX: if you are using two prefixes, you can achieve 11,000 request per second
  - - - :zap:
        
        Uploading/downloading will count to toward the KMS quota
      - :zap:
        
        Region specific, however it's either 5,500, 10,00 or 30,000 requests per second
      - :zap:
        
        Currently, you cannot request a quota increase for KMS
- - - - 3,500 PUT/COPY/POST/DELETE
      - 5,500 GET/HEAD request per second per prefix
- - - - :zap:
        
        If you are using SSE-KMS to encrypt your objects in S3, you must keep in mind the KMS limits
      - :zap:
        
        when you upload a file, you will call GenerateDataKey in the KMS API
      - :zap:
        
        When you download a file, you will call Decrypt in the KMS API
  - - - :zap:
        
        Uploading/ downloading will count toward the KMS quota
      - :zap:
        
        Region-specific, however, it's either 5,500, 100,000, or 30,000 request per second
      - :zap:
        
        Currently, you can not request a quota increase for KMS
- - - - Parallelize downloads by specifying byte ranges
      - If there's failure in the download, it's only for a specific byte range
      - Can be used speed up downloads
      - Can be used to just download partial amounts of the file (e.g., header information)
- - - - 1 file = 1 URL
- - - - :zap:
        
        S3 Managed Keys - SSE - S3
      - :zap:
        
        AWS Key Management Service, Managed Keys - SSE - KMS
      - :zap:
        
        Server Side Encryption With Customer Provided Keys - SSE - C
  - - - SSL/TLS
- - - - write data directly to Amazon Glacier to satisfy compliance needs like SEC rule 17a-4 or HIPAA
- - - - This is location where content will be cached. This is separate to an AWS Region/AZ
  - - - This is the origin of all the files that the CDN will distribute. This can be an S3 Bucket, an EC2 Instance, an Elastic Load Balancer or Route 53
  - - - This is the name given the CDN which consists of a collection of Edge Locations
  - - - Typically used for Websites
  - - - Used for Media Streaming
- - - - you can write to them too
- - - - :zap:
        
        Files are stored as objects in your S3 buckets, accessed through a Network File System (NFS) mount point
      - :zap:
        
        Ownership, permissions, and timestamps are durably stored in S3 in the user-metadata of the object associated with the file
      - :zap:
        
        Once objects are transferred to S3 the can be managed as native S3 objects, and bucket policies such as versioning, lifecycle management, and cross-region replication apply directly to objects stored in you bucket
  - - - :flag-za:
        
        what is ?
        
        :zap:
        
        The volume interface presents you applications with disk volumes using iSCSI block protocol
        
        :zap:
        
        Data written to these volumes can be asynchronously backed up as point-in-time snapshots of you volumes, and stored in the cloud as Amazon EBS snapshots
        
        :zap:
        
        Snapshots are incremental backups that capture only changed blocks. All snapshots storage is also compressed to minimize your storage charges
      - types
        
        Stored Volumes
        
        :zap:
        
        let you store your primary data locally, while asynchronously backing up that data to AWS.
        
        :zap:
        
        Stored volumes provide your on-premises applications with low-latency access to their entire datasets, while providing durable, off-site backups.
        
        :zap:
        
        You can create storage volumes and mount them as iSCSI devices from your on-premises application servers
        
        :zap:
        
        Data written to your stored volumes is stored on your on-premises storage hardware.
        
        :zap:
        
        This data is asynchronously backed up to Amazon Simple Storage Service (Amazon S3) in the form of Amazon Elastic Block Store (Amazon EBS) snapshots.
        
        :zap:
        
        1GB - 16TB in size for Stored Volumes
        
        Cached Volumes
        
        :zap:
        
        Let you use Amazon S3 as you primary data storage while retaining frequently accessed data locally in your storage gateway
        
        :zap:
        
        Cached volumes minimize the need to scale you on-premises storage infrastructure, while still providing your application with low-latency access to their frequently accessed data.
        
        :zap:
        
        You can create storage volumes up to 32 TB in size and attach to them as iSCSI devices from your on-premises application servers.
        
        :zap:
        
        Your gateway stores data that you write to these volumes in Amazon S3 and retains recently read data in your on-premises storage gateway's cache and upload buffer storage.
        
        :zap:
        
        1 GB - 32TB in size for Cached Volumes
  - - - What is
        
        :zap:
        
        Offers a durable, cost-effective solution to archive your data in the AWS cloud.
        
        :zap:
        
        The VTL interface it provides lets you leverage your existing tape-based backup application infrastructure to store data on virtual tape cartridges that you create on your tape gateway.
        
        :zap:
        
        Each tape gateway is preconfigured with a media changer and tape drives, which are available to your existing client backup application as iSCSI derives.
        
        :zap:
        
        You add tape cartridges as you need to archive your data. Supported by NetBackup, Backup Exec, Veeam ...
- - - - For flat files, stored directly on S3
  - - - :zap:
        
        Stored Volumes
        
        Entire Dataset is stored on site and is asynchronously backed up to S3
      - :zap:
        
        Cached Volumes
        
        Entire Dataset is stored on S3 and the most frequently accessed data is cached on site
- - - - :zap:
        
        Storage
      - :zap:
        
        Request and Data Retrievals
      - :zap:
        
        Data Transfer
      - :zap:
        
        Management & Replication
- - - - :zap:
        
        Serverless, nothing to provision, pay per query / per TB scanned
      - :zap:
        
        No need to set up complex Extract/Transform/Load (ETL) process
      - :zap:
        
        Works directly with data stored in S3
  - - - :zap:
        
        Can bed used to query log files stored in S3, e.g. ELB logs, S3 access logs etc
      - :zap:
        
        Generate business reports on data stored in S3
      - :zap:
        
        Analyse AWS cost and usage reports
      - :zap:
        
        Run queries con click-stream data
- - - - :zap:
        
        Personal data used to establish an individual's identity
      - :zap:
        
        This data cloud be exploited by criminals, used in identity theft and financial fraud
      - :zap:
        
        Home address, email address SSN
      - :zap:
        
        Passport number, deriver's license number
      - :zap:
        
        D.O.B, phone number, bank account, credit card number
  - - - :zap:
        
        Security service which uses Machine Learning and NLP (Natural Language Processing) to discover, classify and protect sensitive data stored in S3
        
        :zap:
        
        Uses AI to recognize if your S3 objects contain sensitive data such as PII
        
        :zap:
        
        Dashboards, reporting and alerts
        
        :zap:
        
        Works directly with data stored in S3
        
        :zap:
        
        Can also analyze CloudTrail logs
        
        :zap:
        
        Great for PCI-DSS and preventing ID theft
- - - - :zap:
        
        :biohazard_sign:
        
        Bucket Polices
        
        :zap:
        
        Access Control Lists
      - :zap:
        
        S3 buckets can be configured to create access logs which log all requests made to the S3 bucket. This can be sent to another bucket and even another bucket in another account
  - - - :biohazard_sign:
        
        Key (This is simply the name of the object)
      - :zap:
        
        Value ( This is simply the data and is made up of a sequence of bytes
      - :zap:
        
        Version ID (Important for versioning)
      - :zap:
        
        Metadata (Data about data you are storing)
      - :izakaya_lantern:
        
        Sub resources
        
        :zap:
        
        Access Control Lists
        
        :zap:
        
        Torrent
- - - - :zap:
        
        Users
      - :zap:
        
        Groups
      - :zap:
        
        Roles
      - :zap:
        
        Policies
  - - - IAM is universal. It does not apply to regions at this time
      - The *"root account" is simply the account created when first setup your AWS account. It has complete Admin access
      - New Users have NO permissions when first created
      - New Users are assigned Access Key ID & Secret Access Keys when first created
      - These are not the same as a password. You cannot use the Access key ID & Secret Access Key to Login in to the console. You can use this to access AWS via the APIs and Command line, however
      - You only get to view these once. If you lose them, you have to regenerate them. So, save them in a secure location.
      - Always setup Multifactor Authentication on your root account
      - You can create and customize your own password rotation policies
- - - - people
      - employees of organization
  - - - User in group will inherit the permissions of the group
  - - - called Policy documents
  - - - assign them to AWS resources