Amazon Simple Storage Service - object storage

• scalability, data availability, security, and performance
• config bucket
  • region, name, ownership - ACLs, encryption
• default security → private
• make public using ACL
• remove public access block on bucket → make objects inside bucket public

connect EC2 - S3

• Session Manager enables you to connect to the bastion host instance without the need for specific ports to be open on your firewall or Amazon Virtual Private Cloud (Amazon VPC) security group

aws s3 ls -> list buckets
cd reports + ls -> list objects in bucket

bucket policy

• https://awspolicygen.s3.amazonaws.com/policygen.html
• https://docs.aws.amazon.com/console/s3/bucketpolicyexamplecases
• IAM → roles → EC2InstanceProfileRole → role EC2 uses to connect to S3
• AWS Role ARN (Amazon Resource Name) is a unique identifier for an IAM Role
  • ex. arn:partition:service:region:account-id:resource
• The bucket policy, written in JSON, provides access to the objects stored in the bucket. Bucket policies don't apply to objects owned by other accounts
• principal - EC2 ARN
• S3 Bucket ARN + /* → includes all objects inside bucket

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::655567654413:instance-profile/EC2InstanceProfileRole"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::reportbucket-655567654413/*"
    }
  ]
}

versioning

• stores versions of every object inside bucket - retrievable