Please enable JavaScript.

Coggle requires JavaScript to display documents.

S3 P1 vault M2 (11.glaicier Vault (VAult locl ? (Encorce compliancy…

- - - - Vault allows storage of unlimited number of archives
      - ontainer for storing archives
      - region specific
  - - - ex: the object just upload need to access frequently
      - Upload as standard then change
      - auto transit the object or expire the object based on the age of the object (number of days)
      - Ex:Move all objects older than 30 days to IA. Move all objects older than 90 days to deep glacier
  - - - An archive can be any data such as a photo, video, or document and is a base unit of storage in Glacier.
      - Each archive has a unique ID and an optional description, which can only be specified during the upload of an archive.
      - Glacier assigns the archive an ID, which is unique in the AWS region in which it is stored.
      - Archive can be uploaded in a single request. While for large archives, Glacier provides a multipart upload API that enables uploading an archive in part
- - - - Use java script (XML document) in SLIDE
        
        To make PUT, POST and delete requests against the same bucket .
        
        Origin is from example.com
        
        To specify the rules
  - - - The service will require
      - that the users’ webpages include a JavaScript script that makes authenticated GET requests to the
      - company’s Amazon S3 buck
  - - - Origin comes from where
      - Allow methods means you put and post and delete the object
- - - - steps
        
        crate job in AWS console
        
        Specify data req
        
        job valid for 90 days, after 90 days expire
        
        Attach the snowball to your network and transfer file
        
        set snowball ip using DHCP or static
        
        Download and install snowball client
        
        Auto encrypt data
        
        Track the status
        
        Ship the snowball to nearest AWS DC
      - transfer petabyte pt
        
        1 size is 80 TB
        
        EX: if want transfer 150Tb, need 2 Snowball
        
        =1 Million Gigabyte
      - snowball Network int is RJ45 or fibre
      - To import /export data -S3
        
        fast, shipping take 2 days for snowball. can use expedited shipping
        
        No need to write code
      - Encrypt data end to end
        
        using AES
      - Used case
        
        f you don’t want to make expensive upgrades to your network infrastructure,
        
        if you frequently experience large backlogs of data, i
        
        f you're located in a physically isolated environment, or if you're in an area where high-bandwidth Internet connections are not available or cost-prohibitive.
      - snowcone
        
        https://aws.amazon.com/blogs/storage/making-it-even-simpler-to-create-and-manage-your-aws-snow-family-jobs/
        
        80TB
  - - - Include CPU and storage (100TB)
      - can do local processing
      - transfer file using NFS
    - - compute optimized (42TB)
      - Storage optimized(100TB)
    - - to collect data that they generate in farms, factories, hospitals, aircraft, and oil wells. From shop floor metrics to video surveillance, to information collected by IoT devices, customers are interested in a model that goes beyond straightforward store-and-forward data to collection, and would like to be able to do some local processing as the data arrives. They want to filter, clean, analyze, organize, track, summarize, and monitor the data as it arrives. They want to scan incoming data for patterns or problems, and raise alerts quickly if something interesting is detected.
  - - - =1000 Peta byte
- - - - For Restrict Bucket Access, choose Yes. Means only can access based on distribution URL and not bucket URL
      - Under Origin Access Identity, select Use an Existing Identity and choose the identity we created in the previous section,
      - Under Grant Read Permissions on the Bucket, choose Yes, Update Bucket Policy
      - Under Viewer Protocol Policy, select Redirect HTTP to HTTPS
      - Under Compress Objects Automatically, select Yes to enable gzip compression
      - Under Alternate Domain Names (CNAMEs), enter example.com and www.example.com on separate lines
      - Under SSL Certificate, select the certificate we created in Certificate Manager
      - For Default Root Object, enter index.html
  - - - AWS Certificate Manager can be used to provision SSL certificates for custom domains provided wIt’s i
      - We can also import an existing certificate into CloudFront. It needs to be imported into the US East (N. Virginia) region.
      - Go to ACM Click Request a certificate
      - Select Request a public certificate and click the Request a certificate button on the bottom right
      - Specify the domain names on the certificate (example.com, www.example.com)
      - mportant to know that we can only associate a single certificate to a CloudFront distribution so be sure to include all the names in the certificate. It does support wildcards as well such as *.example.com.
- - - - Granting Permissions to Multiple/cross Accounts with Added Conditions
      - Ex1: Granting Read-Only Permission to an Anonymous User
      - Ex2: Restricting Access to Specific IP Addresses
- - - - Any actions that you do not explicitly allow are denied.
    - - policy generator
        
        account
        
        Means accunt canonical ID
        
        principla
        
        Means user, app and role
        
        action
        
        ex: get objects, put objects and delete objects
        
        ARN resource name MUST COPY
        
        Means bucket name
        
        cclick copy bucket ARN button when select bukcet
        
        Need to put/ * at the back of ARN to allow all
        
        Must click CREATE POLICY and copy and paste the policy
        
        last step: paste and safe the policy
      - Click bucket name, right hand show no permision
      - permission tab
        
        Access to your account
        
        access for other account
        
        public access
        
        s3 log delivery group
      - http://aws-reinvent-audio.s3-website.us-east-2.amazonaws.com/2019/2019_presentations.html
- - - - Will provide error 404 if add wrong / at the back of URL
      - All to Cusotmized error description
- - - - governamce Mode
        
        Specify number of day to disable the delete
        
        Enable privilege delete of Worm-protected object
        
        protect against account compromise
        
        retention can be changed to compliance mode
      - legal hold
        
        Not sure how long u want to lock
      - DT: compliance mod
        
        can not delete unless you delete the ACCOUNT
        
        delete disallow, even for root account
- - - - After all parts of your object are uploaded, Amazon S3 assembles these parts and creates the object
    - - quick recover coz if 1 part missing, can recover
      - upload in parallel to increase throughput
      - No expiry. Either you complete or abort the upload
      - Demo :AWS S3 Tutorial: Multi-part upload with the AWS CLI
      - smaller part minmize the impact to reinitial the whole uiplopad. coz if 1 part fail, just upload that part
    - - initialize upload
        
        AWS will provide upload ID upon splitting the file
      - UIpload step
        
        user specify upload ID and part number between 1 - 10,000
        
        part number can be random ??
        
        Ex: 1, 5. 14
        
        for each successful upload,. aWS will return a Etag
        
        Last step: complete the upload by send all ETAG in the file to aWS
      - complete /abort the upload
      - Using CLI or API