[ Amazon S3 - Buckets ]
- Amazon S3 allows people to store objects (files) in "buckets" (directories)
- Buckets must have a globally unique name
- Buckets are defined at the region level
- Naming convention
1) No uppercase
2) No underscore
3) 3-63 characters long
4) Not an IP
5) Must start with lowercase letter or number
* bucket name must be globally unique
* global console, region service
[ Amazon S3 - Objects ]
- Objects (files) have a key
- The key is the FULL path :
s3://my-bucket/my_forder1/my_file.txt
- The key is composed of prefix(my_forder1/)+object name(my_file.txt)
- There is no concept of directories within buckets
- Object values are the content of the body :
Max Object Size is 5TB
If uploading more than 5GB, must use "multi-part upload"
- Metadata (list of text key/value pairs - system or user metadata)
- Tags (Unicode key/value pair - up to 10) - useful for security/lifecycle
- Version ID (if versioning is enabled)
[ Amazon S3 - Versioning ]
- You can version your files in Amazion S3
- It is enabled at the bucket level
- Same key overwrite will increment the version : 1,2,3..
- It is best practice to version your buckets
Protect against unintended deletes
Easy roll back to previous version
- Any file that is not versioned prior to enabling versioning will have version null (버져닝을 활성화 하기전의 버전은 null)
- Suspending(보류) versioning does not delete the previous versions
[ S3 Encryption for Objects ]
There are 4 methods of encrypting objects in S3
1) SSE-S3 : encrypts S3 objects using keys handled & managed by AWS
- Object is encrypted server side
- AES-256 encryption type
- Must set header : "x-amz-server-side-encryption":"AES256"
2) SSE-KMS : leverage AWS key Management Service to manage encryption keys
- encryption using keys handled & managed by KMS
- KMS Advantages : user control + audit trail
- Object is encrypted server side
- Must set header : "x-amz-server-side-encryption":"aws:kms"
3) SSE-C : when you want to manage your own encryption keys
- server-side encryption using data keys fully manged by the customer outside of AWS
- Amazon S3 does not store the encryption key you provide
- HTTPS must be used
- Encryption key must provided in HTTP headers, for every HTTP request made
4) Client Side Encryption
- Client library such as the Amazone S3 Encryption Client
- Clients must encrypt data temselves before sending to S3
- Clients must encrypt data temselves when retrieving from S3
- Customer fully manages the keys and encryption cycle
# Encryption in transit (SSL/TLS)
- Amazon S3 exposes :
HTTP endpoint : non encrypted
HTTPS endpoint : encryption in flight
- You are free to use the endpoint you want, but HTTPS is recommended
- Most clients would use the HTTPS endpoint by default
* HTTPS is mandatory for SSE-C
