Part 4. AWS at a glance - S3, CloudFront

Amazon S3

Used for backup, storage, recovery, archive, etc. Objects are stored in a bucket, and each object has a key value. Here, Key means Full Path, which means the path to S3 and is expressed as prefix + object name.

• Objects can be accessed through URLs with credentials.
• Versioning is possible at the bucket level. The previous version of Object was null.
• Upload file
• 5TB limit
• When uploading Multi-Part, over 100MB
• Large files can be divided and uploaded in parallel, and documents can be delivered faster using Edge Location.
• Analytics provides the ability to check the contents of each object in a storage class as a .csv file.

S3 Security

To secure S3, you can set IAM to allow access only to specific users. Alternatively, you can use Bucket Policy, Bucket Access Control List, or Object Access Control List.

{
“Version”: “2024–10–16”,
“Statement”: {
“Effect”: “Allow”,
"Principal": "*"
“Action”: [
“s3:GetObject”,
],
“Resource”: [
“arn:aws:s3::accessbucket/*”
]
}
}

• Policy Generator

Object Encryption

Server-Side Encryption (SSE)

-SSE-KMS

• Encrypt the object with the KMS key and store it in the bucket.
• If you create a KMS Key other than the default, a fee is incurred. Default KMS Key is available for free.
• "x-amz-server-side-encryption":"aws:kms"
• If you want to increase quota, you can do so using the Service Quotas Console.
• GenerateDataKey KMS API, Decrypt KMS API -DSSE-KMS
• Saved after going through the encryption process twice with KMS -SSE-C
• How to encrypt using the key provided by the client

Client-Side Encryption (CSE)

This refers to a method of storing the encrypted data itself in S3.

SecureTransport(SSL/TLS)

You can set the policy to provide data only for requests made via https. In addition to this, security can also be processed by allowing the header desired by policy to be stored in the bucket.

{
“Version”: “2024–10–16”,
“Statement”: {
“Effect”: “Allow”,
"Principal": "*"
“Action”: [
“s3:GetObject”,
],
“Resource”: [
“arn:aws:s3::accessbucket/*”
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
}

S3 Cross-Origin Resource Sharing (CORS)

If the request comes from an S3 Bucket such as Cross-Origin rather than Origin, make the Origin data accessible (Access-Control-Allow-Origin).

• Added AllowedOrigins setting in Bucket CORS modification.

MFA Delete

For areas that require security, such as object deletion, deletion can be enabled using MFA.

aws s3api put-bucket-versioning --bucket amzn-s3-demo-bucket1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "SERIAL 123456"

Access Log

You can check logs about access to the S3 Bucket. Be careful not to loop the Logging Bucket separately from the App Bucket.

Pre-Signed URLs

You can create Pre-Signed URLs for your private S3 Bucket and allow other users to download or use it for a certain period of time. It has the advantage of allowing access to other users and not having to disclose the Bucket itself.

S3 Replication

You can replicate objects by setting a replication rule. Replication is possible even if it is not in the same region. Replication in different regions is called Cross-Region Replication (CRR), and replication in the same region is called Same-Region Replication (SRR). Replication occurs asynchronously for new objects. If you want to replicate previous objects, you can use S3 Batch Replication.

• When deleted, a delete marker is displayed in the replication bucket.
• Chaining is not provided. 1 > 2 > 3, not 1 > 3

S3 Storage Classes

Provides the lowest cost storage for a variety of access patterns. Provides high durability and differentiated availability for all classes. (Amazon S3 storage classes type)

• Amazon S3 Standard
• Amazon S3 Intelligent Tiering
• Manage infrequently accessed objects with auto tiering
• Amazon S3 Standard-Infrequent Access
• The cost is small, but there is a cost to recover.
• Amazon S3 One Zone - Infrequent Access
• Amazon S3 Glacier
• Instant Retrieval - Minimum storage period of 90 days, for infrequent but immediate access needs
• Flexible Retrieval - Applicable to archives with a minimum storage period of 90 days, viewed 1-2 times a year, and accessed asynchronously.
• It has Expedited, Standard, and Bulk models.
• Deep Archive - Minimum storage period of 180 days, for datasets that are rarely accessed but still need to be archived.

Lifecycle Rules

• You can set Transition and Expiration Action.
• If you need to restore a deleted object after a certain point, you can use the method of hiding it with a deleted marker and then switching back to Standard IA.

Event Notifications

Event Notifications can be generated according to changes in the object. At this time, add an Access Policy for each service (SNS, SQS, Lambda Function) to receive Event Notifications from other resources. Alternatively, you can use Amazon EventBridge.

S3 Object Lambda

Using Lambda Function, you can add existing database information in S3 or modify some data and deliver it using S3 Object Lambda Access Point. The advantage is that there is no need to create a new bucket for modification.

CloudFront

You can think of it as a CDN. S3 data is brought through CloudFront in a region close to the request, and unlike S3 Cross Region Replication, bucket replication does not occur. And it has the advantage of being able to request and receive static content from anywhere in the world.

• Region is not selected when creating CloudFront.
• CloudFront Caching
• You can perform full or partial invalidation with cache refresh.
• Cache Behaviors: You can configure where to connect to a specific origin depending on the URL path.
• If you just need to connect EC2, EC2 must be public, but if you connect through ALB, private EC2 can be accessed from ALB, so it can be created as private.
• Geographic restrictions are possible.
• Signed-URL / Signed-Cookies (available for multiple files)
• Key Management
• Price Classes - Regional/Multiple/Edge
• Real Time Logs management is possible using Kinesis Data Stream.