AWS Block and File Storage Services – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

Block and file storage questions often test service selection, persistence, Availability Zone scope, performance characteristics, backup behavior, and hybrid connectivity. The main services covered here are Amazon EBS, EC2 instance store, Amazon EFS, Amazon FSx, and AWS Storage Gateway.

Key Concepts

Amazon EBS

Amazon Elastic Block Store (EBS) provides persistent block storage for Amazon EC2. EBS data survives independently of the EC2 instance, although the volume must be attached to an instance to be used as a block device.

Important characteristics:

An EBS volume and the EC2 instance using it must be in the same Availability Zone.
An instance can have multiple EBS volumes attached.
EBS Multi-Attach allows a supported volume to be attached to multiple instances, subject to volume-type, instance, and application-level constraints.
The root volume is normally deleted when an instance terminates because DeleteOnTermination is enabled by default.
Additional data volumes are normally retained when the instance terminates because DeleteOnTermination is disabled by default.
EBS supports encryption for boot and data volumes across supported EBS volume types and EC2 instance families.

EBS volume selection is driven by workload requirements:

General-purpose SSD volumes such as gp3 and gp2 are suitable for common boot volumes and balanced workloads.
Provisioned-IOPS SSD volumes such as io2 and io1 are intended for applications requiring consistently high IOPS and low latency.
Throughput-oriented HDD volumes are lower-cost options for sequential workloads, but they are not suitable as boot volumes and do not support Multi-Attach.

Always verify the exact volume-type limits and feature support for the exam scenario. The architectural distinction is more important than memorizing every quota: SSD volumes target low-latency access, while HDD volumes target economical sequential throughput.

EBS Data Lifecycle Manager

Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs. It can be used to:

Enforce scheduled backup policies.
Retain backups for operational, audit, or compliance requirements.
Remove older snapshots to control storage costs.
Create regularly refreshed AMIs.
Support disaster-recovery policies that copy or coordinate backups across accounts where configured and supported.

DLM is useful when an organization needs consistent, policy-based protection rather than manually managed snapshots.

EBS Snapshots

An EBS snapshot is a point-in-time backup of an EBS volume. Snapshots are stored in Amazon S3-managed infrastructure, but they are managed through EBS rather than accessed as ordinary S3 objects.

Snapshots can be used to:

Create new EBS volumes.
Restore a volume after failure.
Move a workload to another Availability Zone by creating a volume from the snapshot there.
Copy a volume or backup to another AWS Region.
Create an encrypted volume from an unencrypted source through an appropriate copy or restore workflow.

An EBS volume is Availability Zone-specific. A snapshot is Region-specific, so it can be used to create volumes in different Availability Zones within that Region. To use the backup in another Region, copy the snapshot to the target Region.

EBS Encryption

When an EBS volume is encrypted, AWS encrypts:

Data at rest inside the volume.
Data transferred between the volume and the attached EC2 instance.
Snapshots created from the encrypted volume.
New volumes created from those encrypted snapshots.

EBS encryption uses AWS KMS keys. Encryption should generally be enabled at creation time, and account-level default EBS encryption can help enforce the policy consistently.

EBS RAID

RAID is configured by the operating system or application; it is not an EBS-managed feature. The commonly recommended EBS RAID configurations are:

RAID 0: Stripes data across two or more volumes to increase aggregate performance. It provides no redundancy; failure of one volume can make the entire array unavailable.
RAID 1: Mirrors data across volumes for redundancy. A surviving mirror can continue serving data if one volume fails, subject to application and operating-system recovery procedures.

RAID 5 and RAID 6 are generally not recommended for EBS because of their parity overhead and the fact that EBS already provides durable storage at the individual-volume level.

EC2 Instance Store

Instance store provides high-performance local disks physically attached to the host running an EC2 instance. It is ephemeral storage:

Data can be lost when the instance stops, terminates, or is moved to another host.
The volumes cannot be detached and reattached to another instance.
It is appropriate for temporary data, caches, scratch space, buffers, and data that can be regenerated.
Important data must also exist in durable storage or have a reliable backup.

Instance store-backed AMIs use templates for the root volume, with the associated image data stored in Amazon S3. This differs from EBS-backed AMIs, which reference one or more EBS snapshots.

Amazon Machine Images

An AMI contains the information required to launch an EC2 instance, including:

One or more EBS snapshots, or an instance store root-volume template.
Block device mappings that define the volumes attached at launch.
Launch permissions controlling which accounts can use the AMI.

Common AMI categories include community AMIs, AWS Marketplace AMIs, and custom AMIs created by an organization.

Amazon EFS

Amazon Elastic File System (EFS) is a managed, elastic file system accessed using NFS. It is designed for shared file access from multiple compute clients.

Key characteristics:

Storage expands and contracts as data is added or removed.
Capacity can scale to very large sizes without provisioning a fixed volume.
File data and metadata are stored redundantly across multiple Availability Zones within a Region.
EC2 instances in multiple Availability Zones can mount the same file system concurrently.
EFS can support thousands of concurrent clients, subject to service quotas and workload characteristics.
EFS provides read-after-write consistency.
Performance modes include General Purpose and Max I/O; both use SSD-backed storage.

An EFS mount target is created in selected Availability Zones. Clients normally connect through a mount target in their Availability Zone, using security groups to control network access.

EFS can also be accessed from on-premises systems through AWS Direct Connect or a VPN connection. AWS DataSync can transfer files and metadata between existing file systems and EFS.

#### EFS Access Control and Encryption

EFS access control combines several layers:

IAM controls administrative access to the file system and related AWS APIs.
POSIX ownership and permissions control users, groups, files, and directories.
Security groups control network connectivity to EFS mount targets, typically through NFS traffic.

EFS encryption at rest must be enabled when the file system is created and uses AWS KMS. Encryption in transit uses TLS and must be enabled by the client mount configuration.

Amazon FSx

Amazon FSx provides managed file systems designed for specific operating systems and workloads.

#### FSx for Windows File Server

FSx for Windows File Server is designed for Windows applications and supports:

SMB access.
Windows NTFS.
Microsoft Active Directory integration.
Windows ACLs, shadow copies, and user quotas.
Access from many Windows or compatible compute instances.

Within an Availability Zone, the service replicates data for high availability. Multi-AZ deployments provide an active file server and a standby file server in separate Availability Zones.

#### FSx for Lustre

FSx for Lustre is a high-performance, POSIX-compliant file system for compute-intensive workloads such as:

High-performance computing.
Machine learning.
Video processing.
Financial modeling.
Electronic design automation.

It integrates with Amazon S3 so S3 objects can be presented through the file-system interface. Workloads can read source data from S3 and write processed results back to S3.

AWS Storage Gateway

Storage Gateway provides hybrid storage integrations between on-premises environments and AWS. The gateway appliance or virtual machine presents familiar storage protocols locally while using AWS storage services as the durable backend.

#### File Gateway

File Gateway presents SMB or NFS file shares on premises. Files are stored as objects in Amazon S3, with local caching for frequently accessed data. It is useful when existing applications require file protocols but the organization wants the data stored in S3.

#### Volume Gateway

Volume Gateway presents block storage through iSCSI. It has two important operating modes:

Mode	Primary data location	AWS copy	Typical use
Cached volumes	Amazon S3	Full dataset in AWS; frequently accessed data cached on premises	Minimize local storage while retaining the complete dataset in AWS
Stored volumes	On premises	Asynchronous backups to S3	Keep the complete working dataset locally while maintaining AWS backups

Confusing cached and stored volume modes is a frequent exam error.

#### Tape Gateway

Tape Gateway presents virtual tape libraries to existing backup applications. It includes virtual media changers and tape drives and integrates with commonly used backup products such as Veeam, Veritas NetBackup, and Backup Exec.

Data transferred between the gateway and AWS is encrypted using SSL. Tape data stored in Amazon S3 uses server-side encryption with S3-managed keys (SSE-S3) in the scenario described here. Capacity and virtual-tape quotas are service limits; they are usually less important than understanding the tape-backup architecture.

Exam-Relevant Takeaways

Use EBS for persistent block storage attached to EC2; remember that the volume and instance must be in the same Availability Zone.
Use instance store only for temporary, reproducible, or cached data.
Use EFS when many instances, potentially across Availability Zones, need shared elastic NFS storage.
Use FSx for Windows File Server when Windows-native SMB, NTFS, Active Directory, or Windows ACL compatibility is required.
Use FSx for Lustre for high-performance compute workloads that need a POSIX file system and S3 integration.
Use File Gateway when on-premises applications need SMB or NFS access backed by S3 objects.
Use Volume Gateway for iSCSI block storage in hybrid environments; distinguish cached from stored mode.
Use Tape Gateway to preserve existing tape-based backup workflows while storing virtual tapes in AWS.
EBS snapshots are regional; EBS volumes are Availability Zone-specific.
EFS encryption at rest must be selected when the file system is created, while encryption in transit is enabled by the client connection.
Security groups protect EFS network access, while POSIX permissions protect file and directory access.

Architecture Decision Guide

Requirement	Best-fit service or feature	Reason
Persistent block device for one or more EC2 instances	Amazon EBS	Durable block storage with selectable performance tiers
High-performance temporary local disk	EC2 instance store	Very low-latency local storage, but ephemeral
Shared elastic NFS file system across AZs	Amazon EFS	Regional managed file system with concurrent multi-instance access
Windows SMB/NTFS and Active Directory	FSx for Windows File Server	Native Windows file-system compatibility
HPC, ML, or other compute-intensive POSIX workload	FSx for Lustre	High-performance file system with S3 integration
On-premises NFS/SMB access to S3	Storage Gateway File Gateway	Local file protocols with S3 object storage backend
On-premises iSCSI volumes with AWS-backed storage	Storage Gateway Volume Gateway	Block protocol and selectable cached/stored modes
Existing virtual or physical tape backup process	Storage Gateway Tape Gateway	Virtual tapes compatible with backup software
Scheduled EBS backups and AMI retention	Data Lifecycle Manager	Policy-based snapshot and AMI lifecycle management
Volume migration to another AZ or Region	EBS snapshot and, if needed, snapshot copy	Snapshots provide the portable backup boundary

Common Exam Traps

Assuming an EBS volume is regional: EBS volumes are tied to one Availability Zone. Snapshots are regional.
Using instance store for durable application data: Instance store data is ephemeral and cannot be detached for recovery.
Assuming all EBS volumes support the same features: HDD-backed volumes cannot be boot volumes and do not support Multi-Attach.
Confusing EFS with EBS: EFS is shared file storage accessed through NFS; EBS is block storage attached to EC2.
Confusing EFS with FSx: EFS is the general-purpose elastic NFS choice, while FSx targets specific file-system compatibility or high-performance workloads.
Forgetting EFS mount targets: A file system is not reachable merely because EFS exists; mount targets must be available in the required subnets and Availability Zones.
Treating IAM as file-level EFS authorization: IAM governs AWS resource administration. POSIX permissions govern file and directory access, while security groups govern network access.
Selecting FSx for Windows for a Lustre workload: Windows SMB/NTFS requirements point to FSx for Windows; HPC and S3-integrated POSIX requirements point to FSx for Lustre.
Reversing Volume Gateway modes: Cached mode keeps the primary dataset in S3; stored mode keeps the primary dataset on premises and backs it up asynchronously to S3.
Assuming RAID is an AWS storage service: RAID is configured in the operating system. RAID 0 improves performance without redundancy; RAID 1 provides mirroring.
Assuming EFS encryption can be enabled later without design impact: Encryption at rest must be enabled at file-system creation.

Real-World Engineer Notes

Review the DeleteOnTermination setting for every EBS volume in infrastructure-as-code and launch templates. Defaults are not a substitute for an explicit data-retention policy.
Use snapshots and AMIs as part of a tested recovery process. A backup policy without restore testing does not prove recoverability.
Choose EBS volume performance based on measured IOPS, throughput, latency, and queue depth rather than capacity alone.
Treat instance store as a cache or scratch tier. Applications should be able to reconstruct its contents after host loss.
For EFS, design subnets, mount targets, security groups, and DNS resolution together. A permissions policy cannot fix a missing network path.
For EFS and FSx, model throughput and concurrency requirements before selecting performance modes or deployment options.
DataSync is appropriate for managed, repeatable file transfers where metadata such as ownership, timestamps, and permissions must be preserved.
Storage Gateway is valuable when an organization must retain existing file, block, or tape protocols during a migration, but it introduces an on-premises cache or gateway dependency that should be monitored.

Quick Reference Summary

EBS: Persistent AZ-scoped block storage for EC2.
Instance store: Fast, local, ephemeral storage.
EBS snapshots: Point-in-time backups; regional and useful for migration and recovery.
DLM: Automated EBS snapshot and AMI lifecycle policies.
EFS: Elastic, shared NFS file system spanning multiple AZs.
FSx for Windows: Managed SMB/NTFS/Active Directory file storage.
FSx for Lustre: High-performance POSIX file system integrated with S3.
File Gateway: SMB/NFS access to S3-backed files.
Volume Gateway: iSCSI block storage with cached or stored modes.
Tape Gateway: Virtual tape infrastructure for backup applications.

Flashcards

Q: What is the Availability Zone relationship between EBS volumes and EC2 instances?

A: The EBS volume must be in the same Availability Zone as the instance to which it is attached.

Q: What happens to an EBS root volume when an EC2 instance terminates by default?

A: It is normally deleted because DeleteOnTermination is enabled by default.

Q: What is the primary risk of using instance store?

A: It is ephemeral; data can be lost when the instance stops, terminates, or moves to another host.

Q: What is the difference between an EBS volume and an EBS snapshot in geographic scope?

A: A volume is AZ-specific; a snapshot is Region-specific.

Q: Which EBS RAID level improves performance but provides no redundancy?

A: RAID 0.

Q: Which EBS RAID level mirrors data for redundancy?

A: RAID 1.

Q: What protocol does EFS use?

A: NFS.

Q: Which controls are used together to secure EFS access?

A: IAM for administration, security groups for network access, and POSIX permissions for files and directories.

Q: When must EFS encryption at rest be enabled?

A: At file-system creation time.

Q: Which FSx service provides Windows SMB, NTFS, and Active Directory compatibility?

A: FSx for Windows File Server.

Q: Which FSx service is designed for HPC and S3-integrated POSIX workloads?

A: FSx for Lustre.

Q: Where is the primary dataset stored in Volume Gateway cached mode?

A: In Amazon S3, with frequently accessed data cached on premises.

Q: Where is the primary dataset stored in Volume Gateway stored mode?

A: On premises, with asynchronous backups to Amazon S3.

Practice Questions

Question 1

A company runs a stateful application on an EC2 instance. The application requires persistent block storage and the operations team wants to recreate the volume in another Availability Zone after a failure. Which design best meets the requirement?

A. Store the data on instance store and create an AMI nightly
B. Store the data on EBS and create scheduled EBS snapshots
C. Store the data on EFS and attach it as a block device
D. Store the data on File Gateway and mount it using iSCSI

Correct answer: B

EBS provides persistent block storage for EC2, and snapshots can be used to create a replacement volume in another Availability Zone. Instance store is ephemeral, EFS is file storage rather than block storage, and File Gateway provides SMB/NFS rather than an EC2-attached EBS volume.

Question 2

A media-processing fleet runs in three Availability Zones. All instances must concurrently access a shared file system whose capacity should grow automatically as files are added. Which service is the best fit?

A. One EBS volume with Multi-Attach
B. Instance store on every instance
C. Amazon EFS with mount targets in the required Availability Zones
D. FSx for Windows File Server using local disk mounts

Correct answer: C

EFS provides elastic shared NFS storage accessible concurrently by instances across Availability Zones. Multi-Attach is not a general replacement for a shared file system, and instance store is local and ephemeral.

Question 3

A legacy Windows application requires SMB, NTFS permissions, Active Directory integration, shadow copies, and user quotas. Which AWS service should the architect select?

A. Amazon EFS
B. FSx for Lustre
C. FSx for Windows File Server
D. Storage Gateway Tape Gateway

Correct answer: C

FSx for Windows File Server provides managed Windows-native file storage with SMB, NTFS, Active Directory, ACLs, shadow copies, and quotas. EFS uses NFS, and FSx for Lustre is intended for high-performance POSIX workloads.

Question 4

An organization wants its on-premises backup application to continue using virtual tape libraries while storing backup data in AWS. Which solution is most appropriate?

A. Storage Gateway Tape Gateway
B. Storage Gateway File Gateway
C. Storage Gateway Volume Gateway cached mode
D. Amazon EFS

Correct answer: A

Tape Gateway presents virtual tapes, media changers, and tape drives to compatible backup applications. File Gateway provides SMB/NFS access, while Volume Gateway provides iSCSI block volumes.

Question 5

An on-premises application uses iSCSI and must keep the complete working dataset locally, while maintaining asynchronous backups in AWS. Which Storage Gateway mode should be used?

A. File Gateway
B. Volume Gateway cached volumes
C. Volume Gateway stored volumes
D. Tape Gateway

Correct answer: C

Stored volumes keep the complete dataset on premises and asynchronously back it up to S3. Cached volumes keep the complete dataset in S3 and retain only frequently accessed data in the local cache.