Amazon S3 Architecture Patterns and Design Decisions – SAP-C02 Study Guide

Purpose of This Lesson

Amazon S3 architecture questions often describe a business requirement and expect the correct combination of storage class, lifecycle rule, replication, encryption, event notification, or access-control mechanism. The key is to map the requirement to the narrowest S3 feature that satisfies it while considering retrieval needs, security, cost, and operational behavior.

Key Concepts

Protecting Against Accidental Deletion: S3 Versioning

Enable S3 Versioning when objects must be recoverable after accidental overwrite or deletion. S3 retains multiple versions of an object, allowing an earlier version to be restored.

Important considerations:

• A simple delete in a versioning-enabled bucket usually creates a delete marker rather than permanently removing the object.
• Versioning protects against accidental changes, but it does not by itself prevent an authorized user or administrator from permanently deleting object versions.
• For stronger protection against destructive actions, consider S3 Object Lock, restrictive IAM policies, MFA Delete where applicable, and separate administrative controls.
• Versioning can increase storage consumption because old versions remain stored until explicitly deleted or transitioned.

Lifecycle Transitions for Changing Access Patterns

A common pattern is data that is frequently accessed initially and then becomes less active while still requiring immediate retrieval. A lifecycle rule can transition objects from S3 Standard to S3 Standard-IA after a defined period, such as 30 days.

S3 Standard-IA is appropriate when:

• Objects are accessed less frequently but must remain immediately available.
• The data is long-lived enough to justify the class’s minimum storage duration.
• The workload can tolerate per-request retrieval charges.

S3 Standard-IA has a minimum storage duration of 30 days. Glacier Instant Retrieval may be a better fit for rarely accessed data that still requires millisecond retrieval, while Glacier Flexible Retrieval or Glacier Deep Archive is appropriate when retrieval can take longer.

Cross-Region Replication for a Folder or Prefix

S3 Cross-Region Replication (CRR) asynchronously copies objects from a source bucket to a bucket in another AWS Region. Replication rules can target objects based on a prefix or object tags, allowing a particular logical folder to be replicated.

Typical uses include:

• Disaster recovery and regional resilience
• Compliance copies in another Region
• Geographic distribution of selected datasets
• Replication of backups or critical application data

Replication is not retroactive by default. Existing objects may require an S3 Batch Replication operation or another explicit copy process. S3 Versioning must be enabled on both the source and destination buckets for standard replication configurations.

Long-Term Storage of Previous Versions

To control the cost of versioned data, configure a lifecycle rule for noncurrent object versions. For example, previous versions can transition to S3 Glacier Deep Archive after they are no longer current.

A lifecycle design can include separate rules for:

• Current object versions
• Noncurrent object versions
• Delete markers
• Incomplete multipart uploads

Glacier Deep Archive provides very low-cost long-term storage, but retrieval is slow and incurs retrieval charges. It is suitable for archival data that is rarely needed, not for data requiring immediate access.

Client-Side Encryption with Application-Controlled Keys

Use client-side encryption when the application must encrypt data before it reaches S3 and retain control of the encryption process and keys.

With client-side encryption:

• The application encrypts the object before uploading it.
• S3 stores ciphertext and does not perform the primary encryption operation.
• The application or its encryption library manages key usage and decryption.
• AWS KMS keys can be involved in envelope-encryption designs, but the application remains responsible for the client-side encryption workflow.

This differs from server-side encryption, where S3 encrypts the object after receiving it:

• SSE-S3: S3 manages the encryption keys.
• SSE-KMS: AWS KMS manages the customer KMS key and key policies.
• SSE-C: The customer supplies the encryption key with each request, while S3 performs the encryption operation.

Encrypting Existing Unencrypted Objects

Default bucket encryption applies to new uploads; it does not automatically transform objects that are already stored unencrypted.

To encrypt existing objects, perform an object rewrite, such as:

• Copying each object onto itself with the required server-side encryption settings
• Using S3 Batch Operations for large collections
• Downloading, encrypting, and uploading through the application when client-side encryption is required

For new uploads, enforce encryption using bucket policies that deny PutObject requests lacking the required encryption headers or condition keys. Also consider enabling S3 Block Public Access and reviewing existing object permissions.

Notifications When Objects Are Deleted

Configure an S3 Event Notification for object-removal events and send the notification to Amazon SNS, SQS, or AWS Lambda.

For deletion monitoring, account for versioning behavior:

• A normal delete in a versioned bucket may create a delete marker.
• Permanently deleting an object version produces a different removal event.
• The event type and notification configuration should match the deletion behavior being monitored.

The destination must allow S3 to publish or invoke it, and event notifications are generally designed for at-least-once delivery. For more advanced routing, filtering, or centralized event processing, Amazon EventBridge can also consume S3 events.

Temporary Access Without AWS Credentials: Presigned URLs

A presigned URL grants time-limited access to a specific S3 object using the permissions of the IAM principal that created the URL. It is useful for customers or external users who do not have AWS credentials.

A presigned URL can support operations such as:

• Downloading a private object
• Uploading an object to a controlled key prefix

Security and operational points:

• Anyone possessing the URL can use it until it expires or access is otherwise revoked.
• The creator must have permission for the underlying S3 operation.
• Keep the expiration period as short as practical.
• Use object-key restrictions and application authorization before issuing URLs.
• A presigned URL is not the same as making an object public.

Cross-Account Access with IAM Roles

For programmatic and console access across AWS accounts, establish cross-account access using an IAM role in the target account.

The standard pattern is:

1. Create a role in the target account.
2. Add a trust policy allowing an approved principal from the source account to assume the role.
3. Attach permissions to the role for the required AWS resources and actions.
4. Allow the source principal to call sts:AssumeRole.
5. For console access, users switch roles into the target account.

Cross-account access requires both sides of the trust relationship: the target role must trust the source principal, and the source principal must be permitted to assume the role. For S3 specifically, bucket policies, KMS key policies, and organization-level controls may also affect access.

Exam-Relevant Takeaways

• Use S3 Versioning to recover from accidental overwrites and ordinary deletes.
• Use a lifecycle transition when an object’s access pattern changes over time.
• Choose S3 Standard-IA for infrequent access with immediate retrieval, but account for minimum storage duration and retrieval charges.
• Use S3 CRR for asynchronous replication to another Region; use prefixes or tags to select data.
• Use a noncurrent-version lifecycle rule to transition old versions to archival storage.
• Use S3 Glacier Deep Archive for the lowest-cost long-term archive when slow retrieval is acceptable.
• Use client-side encryption when the application must control encryption before data reaches S3.
• Existing unencrypted objects require a rewrite or batch copy; changing default encryption affects future uploads only.
• Use S3 event notifications to notify SNS, SQS, or Lambda about object-removal events.
• Use presigned URLs for temporary object access without giving users AWS credentials.
• Use IAM roles and AWS STS AssumeRole for cross-account console and API access.

Architecture Decision Guide

Requirement	Recommended S3 feature	Key caveat
Recover from accidental overwrite or deletion	S3 Versioning	Old versions consume storage and can still be permanently deleted by authorized principals
Frequent access initially, then infrequent but immediate retrieval	Lifecycle transition to S3 Standard-IA	Minimum storage duration and retrieval charges apply
Replicate selected objects to another Region	S3 CRR with a prefix or tag filter	Requires replication configuration and appropriate permissions; existing objects need separate handling
Archive noncurrent versions at the lowest storage cost	Lifecycle rule for noncurrent versions to S3 Glacier Deep Archive	Retrieval is slow and charged
Application encrypts data and controls encryption keys	Client-side encryption	The application owns encryption, key access, and decryption operations
Encrypt objects already stored without encryption	Rewrite or S3 Batch Operations copy with encryption	Bucket default encryption does not modify existing objects
Notify a system when objects are removed	S3 Event Notifications to SNS, SQS, or Lambda	Match event types to versioning and delete-marker behavior
Give an external customer temporary object access	Presigned URL	Possession of the URL grants access until expiration or revocation
Access resources from another AWS account	Cross-account IAM role	Trust policy and permissions must both be configured

Common Exam Traps

• Confusing Standard-IA with archival classes: Standard-IA provides immediate access; Glacier classes involve different retrieval characteristics and costs.
• Assuming default encryption encrypts existing data: It applies to new objects and does not automatically rewrite objects already in the bucket.
• Treating versioning as a complete deletion-protection control: Versioning preserves versions but does not prevent privileged permanent deletion.
• Assuming CRR copies historical objects automatically: Replication normally applies to eligible objects after configuration; use batch replication or another process for existing data.
• Ignoring noncurrent versions: A versioned bucket can accumulate large amounts of old data unless lifecycle rules manage it.
• Making an object public for temporary access: A presigned URL provides controlled, expiring access without public exposure.
• Using an IAM user for cross-account administration: Cross-account roles are the standard scalable pattern and provide temporary credentials.
• Ignoring KMS permissions: If SSE-KMS is used, the principal also needs permission to use the KMS key, and the key policy must allow the required access.
• Assuming every delete produces the same event: Delete markers and permanent version deletion can generate different event behavior.

Real-World Engineer Notes

• Test lifecycle rules with representative object sizes and access patterns. Storage-class minimums, request charges, and retrieval charges can change the cost outcome.
• Combine versioning with lifecycle expiration or archival rules; otherwise, recovery protection can become an uncontrolled storage bill.
• Use S3 Inventory, Storage Lens, and CloudTrail data events when you need auditing beyond application-level notifications.
• For a backup or disaster-recovery design, replication alone may not satisfy recovery objectives. Validate replication latency, destination-account isolation, restore procedures, and whether deletes are replicated.
• Keep presigned URLs short-lived and generate them only after application-level authorization. Avoid embedding sensitive object names when URL exposure is a concern.
• For cross-account access to SSE-KMS-encrypted objects, coordinate IAM policies, S3 bucket policies, and KMS key policies.
• Bucket default encryption is a useful baseline, but use policy enforcement and monitoring when encryption is mandatory.

Quick Reference Summary

• Accidental deletion: S3 Versioning
• Immediate retrieval after infrequent access: S3 Standard-IA or Glacier Instant Retrieval, depending on access profile and cost model
• Selected data in another Region: S3 CRR using a prefix or tag filter
• Long-term storage of old versions: Noncurrent-version lifecycle transition to Glacier Deep Archive
• Application-controlled encryption: Client-side encryption
• Existing unencrypted objects: Rewrite or batch copy with encryption
• Deletion notification: S3 Event Notification to SNS, SQS, or Lambda
• Temporary unauthenticated-by-AWS-credentials access: Presigned URL
• Cross-account AWS access: IAM role assumed through AWS STS

Flashcards

1. What S3 feature protects against accidental overwrite or ordinary deletion?

Answer: S3 Versioning. It preserves prior object versions and typically creates a delete marker for a simple delete.

2. Which storage class suits data that becomes infrequently accessed but must be immediately retrievable?

Answer: S3 Standard-IA, assuming its minimum storage duration and retrieval charges are acceptable.

3. How can CRR replicate only objects in a logical S3 folder?

Answer: Configure a replication rule using the folder’s key prefix, or use object tags as a filter.

4. How are old versions targeted by lifecycle rules?

Answer: Use lifecycle actions for noncurrent object versions.

5. Which S3 storage class is intended for the lowest-cost, very long-term archive?

Answer: S3 Glacier Deep Archive, when slow retrieval is acceptable.

6. When should client-side encryption be selected?

Answer: When the application must encrypt data before upload and control the encryption keys and decryption process.

7. Does enabling S3 default encryption encrypt existing objects?

Answer: No. Existing objects must be rewritten or copied with encryption settings.

8. How can S3 notify an administrator or system about object deletion?

Answer: Configure object-removal event notifications to SNS, SQS, Lambda, or an EventBridge-based workflow.

9. How can an external customer download a private S3 object without AWS credentials?

Answer: Provide a presigned URL with a limited expiration time.

10. What is the standard cross-account access mechanism in AWS?

Answer: An IAM role in the target account that is assumed through AWS STS.

Practice Questions

Question 1

A company stores application logs in S3. Logs are accessed frequently for the first 30 days, then are rarely accessed but must be available immediately when requested. Which design is most appropriate?

A. Transition objects to S3 Glacier Deep Archive after 30 days

B. Transition objects to S3 Standard-IA after 30 days

C. Replicate objects to another Region using CRR after 30 days

D. Delete objects after 30 days and retain only delete markers

Correct answer: B

Explanation: S3 Standard-IA is designed for infrequently accessed data that must remain immediately retrievable. Glacier Deep Archive is intended for archival data with slower retrieval.

Question 2

An organization has a version-enabled bucket and wants old object versions retained for compliance at the lowest possible storage cost. Retrieval can take many hours. Which solution should be used?

A. Transition current versions to S3 Standard-IA

B. Configure a noncurrent-version lifecycle transition to S3 Glacier Deep Archive

C. Disable versioning and enable S3 Intelligent-Tiering

D. Create a presigned URL for each old version

Correct answer: B

Explanation: A lifecycle rule can target noncurrent versions and transition them to S3 Glacier Deep Archive, which is optimized for very low-cost long-term archival.

Question 3

A software vendor needs to let customers download a private update package from S3. Customers do not have AWS accounts, and access must expire after two hours. What should the vendor implement?

A. Make the object public through a bucket policy

B. Create an IAM user for every customer

C. Generate a two-hour presigned URL

D. Configure CRR to a public bucket

Correct answer: C

Explanation: A presigned URL grants time-limited access to a specific object without requiring the customer to possess AWS credentials or making the object public.

Question 4

An administrator must encrypt 50 TB of existing unencrypted S3 objects using SSE-KMS. The bucket’s default encryption is already configured. What must the organization do?

A. Wait for S3 to apply default encryption to the existing objects

B. Rewrite or batch-copy the objects with SSE-KMS specified

C. Enable versioning, which automatically encrypts old objects

D. Add a presigned URL requirement to the bucket policy

Correct answer: B

Explanation: Default bucket encryption applies to new uploads. Existing objects must be rewritten, copied, or processed through S3 Batch Operations with the required encryption configuration.

Question 5

A security team in Account A needs console and API access to resources in Account B. The access must be centrally controlled and use temporary credentials. Which solution is best?

A. Share the root credentials for Account B

B. Create IAM users in Account B and distribute access keys

C. Create a role in Account B trusted by an approved principal in Account A

D. Make all resources in Account B publicly accessible

Correct answer: C

Explanation: A cross-account IAM role provides controlled console role switching and programmatic access through AWS STS temporary credentials. The role trust policy and the source principal’s sts:AssumeRole permission must both be configured.