Table of contents
S3 = Simple Storage Service (SSS)
- what does it do?
Object Storage: S3 is a scalable object storage service that allows you to store and retrieve data in the form of objects. Each object consists of data, metadata, and a unique identifier (key).
- Durability and Availability: S3 is designed for high durability and availability, making it suitable for storing critical data. It automatically replicates data across multiple facilities to ensure durability.
- Access Control: S3 provides access control mechanisms such as bucket policies, IAM roles, and ACLs to manage permissions and control access to your data.
Cross region replication (CRR), is not the best solution for cross continent data transfer
- Is there a better solution?
Ans: Yes, use S3 Transfer Acceleration instead of CRR. Espically for cross continent data transfer.
- S3 Transfer Acceleration uses Amazon CloudFront’s globally distributed edge locations (via best network path) to accelerate uploads and downloads to and from S3 buckets. It optimizes the transfer of data over long distances, reducing latency and improving transfer speeds, via muti-part uploads
Preventing accidental deletion of S3 objects
- S3 provides a feature called Object Lock that allows you to enforce retention policies on objects, preventing them from being deleted or modified for a specified period of time. This feature is useful
Enable MFA deletion on S3 buckets to require multi-factor authentication (MFA) for deleting objects, adding an extra layer of security against accidental or unauthorized deletions.
- Enable versioning on S3 buckets to allow you to recover previous versions in case of accidental deletion or modification.
NO: Chaning S3 bucket policy to deny delete action is not a good idea, as it can lead to unintended consequences and make it difficult to manage your S3 resources effectively. Instead, consider using the following approaches:
- Use IAM policies: Create IAM policies that grant specific permissions to users or roles, allowing them to perform only the necessary actions on S3 buckets and objects. This way, you can control access without denying delete actions globally.
- Implement S3 bucket policies: Use bucket policies to define fine-grained access controls for specific users or groups. You can allow or deny actions based on conditions such as IP address, time of day, or other factors.
- Enable MFA (Multi-Factor Authentication): Require MFA for sensitive actions like deleting objects. This adds an extra layer of security and helps prevent accidental deletions.