S3
What is S3
Amazon S3 (Simple Storage Service) is an object storage service that allows you to store and retrieve any amount of data from anywhere on the internet.
Think of it like Google Drive, but more powerful and programmable.
Core Concepts:
Bucket
A container for storing files (like a folder)
Object
A file + its metadata (e.g., image, video, PDF)
Key
Unique name of the file in the bucket
Region
Data center location where your bucket is hosted
Types of Uploads (Uploading Methods)
1. Single PUT upload (Simple Upload)
Uploads files up to 5GB in one request.
Best for small files.
2. Multipart Upload ✅ (Recommended for big files)
Splits large files (up to 5TB) into parts.
Upload parts in parallel → faster and more reliable.
If upload fails midway, you can resume where it left off.
3. S3 Transfer Acceleration
Uses AWS edge locations to speed up uploads from faraway places.
Good for global applications or poor network conditions.
4. Presigned URLs
Temporary, secure link to upload/download files without credentials.
Example: Let users upload photos without giving them full access.
Storage Types:
S3 Standard
Frequently accessed files
💰
Milliseconds
S3 Intelligent-Tiering
Auto-moves files to save cost
💰⬇
Milliseconds
S3 Standard-IA
Infrequent access
💸
Milliseconds
S3 One Zone-IA
Infrequent, 1 AZ only
💸⬇
Milliseconds
S3 Glacier
Archival (cold storage)
🔒
Minutes to hours
S3 Glacier Deep Archive
Long-term backups
🔒💸
Up to 12 hours
Security in S3
IAM Policies:
Control who can access buckets/objects.
Example: Only allow access from specific IAM roles.
Bucket Policies:
Set rules at the bucket level (like a firewall for a bucket).
Encryption:
SSE-S3: AWS-managed encryption.
SSE-KMS: You manage keys with AWS Key Management Service.
SSE-C: You manage your own encryption keys.
Access Logging:
Track all access to your S3 bucket (for security & auditing).
Capacity& Limits
Max file size
5TB (must use multipart for >5GB)
Max bucket per account
100 by default (can request more)
Unlimited objects
No limit on number of files
Max object size (PUT)
5GB for single PUT; use multipart for bigger
What is AWS KMS?
AWS KMS is a managed encryption key service. It helps you create, store, and control cryptographic keys to encrypt your data securely.
Think of it as a locksmith service in the cloud: You create “keys” to lock (encrypt) and unlock (decrypt) your data safely.
Core Conepts
Customer Master Key (CMK)
The main encryption key you create or AWS manages to encrypt/decrypt your data.
Data Key
Temporary keys generated by KMS to encrypt your actual data (like file contents).
Key Alias
Friendly name you assign to your CMK (e.g., alias/myAppKey)
Key Policy
JSON document that defines who can use or manage your keys
Grant
Temporary permission to use a CMK without modifying its policy
Key Rotation
Automatically replace CMKs after a period for better security
How KMS Works (Simplified)
You create a CMK in KMS (either AWS-managed or customer-managed).
Your app or AWS service requests a data key from KMS.
KMS generates a data key:
Returns the plaintext data key to your app.
Returns the encrypted (wrapped) data key to store safely.
Your app uses the plaintext data key to encrypt data locally.
When you want to decrypt, your app sends the encrypted data key to KMS, which decrypts it and returns the plaintext key.
Types of CMKs
AWS Managed CMK
Automatically created and managed by AWS
AWS
Easy encryption with minimal effort
Customer Managed CMK
Created and managed by you
You (full control)
When you need fine control & auditing
AWS Owned CMK
Used internally by AWS services, not visible to you
AWS
Used by AWS behind the scenes
KMS vs AWS Enc
S3 Encryption
Objects
Yes (optional)
Low to Medium
EBS Encryption
Disk volumes
Yes (optional)
Medium
RDS Encryption
Databases
Yes (optional)
Medium
KMS
Keys (for encrypting data)
—
High (you manage keys)
Encryption is like sending secret messages
Imagine you want to send a secret message to your friend so no one else can read it.
1. Symmetric Encryption (Secret Code with One Key)
You and your friend share the same secret key — like a special password.
You use that key to lock (encrypt) the message before sending it.
Your friend uses the same key to unlock (decrypt) the message and read it.
It’s like having one magic key that opens and locks your secret box.
Example: You and your friend both have the same key to a treasure chest. You lock the chest with the key, send it, and your friend unlocks it with the same key.
2. Asymmetric Encryption (Secret Code with Two Keys)
You have two keys: a public key and a private key.
The public key is like a locked mailbox anyone can put letters into.
The private key is your own secret key to open the mailbox and read letters.
Your friend uses your public key to lock (encrypt) the message.
Only you can unlock (decrypt) the message with your private key.
No one else can open the mailbox because they don’t have the private key.
Example: You have a special mailbox with a slot (public key) anyone can drop letters in, but only you have the key to open it and read the letters.
Why both?
Symmetric is fast but you have to share the same secret key safely.
Asymmetric is slower but you don’t have to share your private key — more secure for sending keys!
SSE vs CSE (Side-by-Side Table)
Who encrypts the data?
AWS encrypts after upload
You encrypt before upload
Who stores the key?
KMS in AWS
You or KMS locally
Ease of use
✅ Easy
❗More complex
Can AWS see data?
AWS sees it before encrypting
No — AWS sees only encrypted data
Common use case
S3 buckets, EBS, RDS
Finance, healthcare, strict privacy
AWS KMS used?
Yes
Optional (can use KMS or local key)
KMS = your key vault in the cloud (store + control encryption keys).
SSE-KMS = AWS encrypts after receiving your data using KMS.
CSE = You encrypt the data before sending it — AWS just stores it.
S3 Lifecycle:
Standard
You use it often
💰💰💰
Fast (ms)
Standard-IA
Rarely accessed files
💰💰
Fast (ms)
One Zone-IA
Rare access, 1 AZ only
💰
Fast (ms)
Glacier
Archive, infrequent access
💸
Minutes-hours
Glacier Deep Archive
Long-term backup only
🪙 Super cheap
Hours
S3 Replication means:
Automatically copying files from one bucket to another (even in a different region or account).
✅ It's used for:
Backup
Disaster recovery
Cross-region compliance
Data duplication
Last updated