AWS SAA-C02/C03 Cheat Sheet

S3

Which Storage Class to use?
- S3 Intelligent-Tiering
  - Changing (user-generated content), unpredictable (analytics, data lakes), or unknown (new applications) access patterns
- S3 Standard
  - Known access patterns
  - Frequently accessed data
  - Access data more than once a month
- S3 Standard-Infrequent Access
  - Known access patterns
  - data retained for at least a month
  - accessed once every month or two
- S3 One Zone-Infrequent Access
  - reproducible objects
  - data that has a lower resiliency requirement
- S3 Glacier Instant Retrieval
  - rarely accessed archive data
  - archive data that needs immediate access
  - delivers milliseconds retrieval
  - data that is accessed 2-3 times per year
- S3 Glacier Flexible Retrieval
  - rarely accessed archive data
  - does not require immediate access
  - data retrieval within minutes to hours (up to 12hrs)
  - free bulk retrieval
- S3 Glacier Deep Archive
  - To save even more on archive storage
  - lowest cost storage in Amazon S3
  - data retrieval within hours (12hr to 48hrs)

Replication at S3
- SRR – Same Region Replication
  - Aggregate logs into a single bucket – If you store logs in multiple buckets or across multiple accounts, you can easily replicate logs into a single, in-Region bucket. Doing so allows for simpler processing of logs in a single location.
  - Configure live replication between production and test accounts – If you or your customers have production and test accounts that use the same data, you can replicate objects between those multiple accounts, while maintaining object metadata.
  - Abide by data sovereignty laws – You might be required to store multiple copies of your data in separate AWS accounts within a certain Region. Same-Region Replication can help you automatically replicate critical data when compliance regulations don't allow the data to leave your country.
Encryption at S3
- Server-Side Encryption
  - Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.
- Client-Side Encryption
  - Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.
- AWS KMS (SSE-KMS)
  - Encryption at rest
  - Automatic key rotation every 1 year
  - Operational efficiency (least manual efforts)
- Server-side Encryption (SSE):
  - Customer Provided Keys (SSE-C)
  - S3 Managed Keys (SSE-S3)
  - KMS Managed Keys (SSE-KMS)
- Client-side Encryption (CSE):
  - Customer managed master encryption keys (CSE-C)
  - KMS managed master encryption keys (CSE-KMS)
- In order to ensure all objects uploaded to S3 are encrypted, create an S3 bucket policy that denies any S3 Put request that does not include the x-amz-server-side-encryption header.
  - s3:x-amz-server-side-encryption: AES256 🡸 use S3-managed keys
  - s3:x-amz-server-side-encryption: aws:kms 🡸 use AWS KMS managed keys

https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/

For cost effective analysis on data stored on S3 use Amazon Athena to run SQL queries
S3 Object Lock
- prevent deleting or modifying object for fixed amount of time.
- Object Lock can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely
- Object Lock to help meet regulatory requirements that require WORM (write-once-read-many) storage
- Adds layer of protection against object changes and deletion
- Object locks must be enabled at the time of creation of buckets (new bucket)
- Bucket versioning is automatically enabled (cant be disabled) for Object lock enabled buckets
S3 Static website hosting
- Only for static content, can also contain client-side scripts.
- Does NOT support Server-side processing/scripting like PHP, JSP, or ASP.NET.
Accessing S3 from EC2 or ECS
- IAM Role or Instance profile attached to EC2 to access S3
- Data transfer between S3 and EC2 in same region is FREE
S3 Transfer Acceleration

fast, easy, and secure transfers of files over long distances between your client and an S3 bucket
S3 Transfer acceleration uses globally distributed edge locations in Amazon CloudFront
Additional data transfer charges might apply.
Use for large scale (more than 20GB) download and upload of data into S3 from various edge location
Use cases
- Your customers upload to a centralized bucket from all over the world.
- You transfer gigabytes to terabytes of data on a regular basis across continents.
- You can't use all of your available bandwidth over the internet when uploading to Amazon S3.

S3 Cost
- Enabling versioning will have additional cost (each versioned objects are charged)
- Incomplete S3 multipart uploads are charged
- Data transfer cost between S3 buckets in same region is free
VPC endpoint and S3
- VPC endpoint for Amazon S3 to upload files/images from EC2 instance in private subnet
- VPC endpoint for Amazon S3 reduces Direct connect costs