Protecting data on Amazon S3 – AWS Services for Data Storage – MLS-C01 Study Guide

Protecting data on Amazon S3

In this section, you will learn how to record every version of an object. Along with durability, Amazon provides several techniques to secure the data in S3. Some of those techniques involve enabling versioning and encrypting the objects.

Versioning helps you to roll back to a previous version if any problem occurs with the current object during update, delete, or put operations.

Through encryption, you can control the access of an object. You need the appropriate key to read and write an object. You will also learn Multi-Factor Authentication (MFA) for delete operations. Amazon also allows Cross-Region Replication (CRR) to maintain a copy of an object in another Region, which can be used for data backup during any disaster, for further redundancy, or for the enhancement of data access speed in different Regions.

Applying bucket versioning

Let’s now understand how you can enable bucket versioning with the help of some hands-on examples. Bucket versioning can be applied while creating a bucket from the AWS S3 console:

  1. To enable versioning on a bucket from the command line, a bucket must be created first and then versioning can be enabled, as shown in the following example. In this example, I have created a bucket, version-demo-mlpractice, and enabled versioning through the put-bucket-versioning command:

$ aws s3 mb s3://version-demo-mlpractice/
$ aws s3api put-bucket-versioning –bucket version-demo-mlpractice –versioning-configuration Status=Enabled
$ aws s3api get-bucket-versioning –bucket version-demo-mlpractice
{
    “Status”: “Enabled”
}

  • You have not created this bucket with any kind of encryption. So, if you run aws s3api get-bucket-encryption –bucket version-demo-mlpractice, then it will output an error that says the following:

The server side encryption configuration was not found

  • Server-Side Encryption (SSE) can be applied from the AWS S3 console while creating a bucket. This is called bucket default encryption. You can also apply SSE via the command line using the put-bucket-encryption API. The command will look like this:

$ aws s3api put-bucket-encryption –bucket version-demo-mlpractice –server-side-encryption-configuration ‘{“Rules”:[{“ApplyServerSideEncryptionByDefault”:
{“SSEAlgorithm”:”AES256″}}]}’

  • This can be verified using the following command: aws s3api get-bucket-encryption –bucket version-demo-mlpractice.

You will learn more about encryption in the next section.