S3

Navigate to the S3 Dashboard and select the desired bucket.

💡 This is the entry point for managing bucket-specific configurations.

Go to the 'Management' tab and select 'Lifecycle Rules'.

💡 The 'Management' tab contains options for lifecycle configuration, replication, and other advanced settings.

Click 'Create lifecycle rule'.

💡 Initiates the wizard for defining a new lifecycle policy.

Provide a 'Lifecycle rule name' (e.g., 'CS demo life cycle rule').

💡 A descriptive name helps in identifying and managing rules.

Define the 'Scope' for the rule: apply to all objects, specific prefix, or tags.

💡 Determines which objects within the bucket the rule will affect.

Configure 'Transition current versions of objects between storage classes' by selecting a storage class (e.g., S3 Standard-IA, S3 Glacier Deep Archive) and specifying the number of days for transition.

💡 Automates cost optimization by moving data to cheaper tiers as it ages. Multiple transitions can be chained.

Configure 'Transition non-current versions of objects between storage classes' similarly, if versioning is enabled and you wish to manage old versions.

💡 Allows separate management of older object versions, further optimizing costs while retaining a recovery history.

Configure 'Expire objects' by specifying the number of days after which objects will be permanently deleted.

💡 Ensures data is removed after its retention period, crucial for compliance and cost management.

Save the changes to create the lifecycle rule.

💡 Applies the defined policy to the S3 bucket.

Navigate to S3 in the AWS console.

💡 This is the entry point for S3 management.

Copy the name of the lab-provided source bucket (e.g., `appconfigprod1`). Click 'Create bucket'.

💡 Starting the process of creating the destination bucket.

Set the destination bucket's name (e.g., paste `appconfigprod1` and replace it with `appconfigprod2` to ensure global uniqueness). Select a different AWS Region (e.g., `US West (Oregon) us-west-2`).

💡 Bucket names must be globally unique. Replicating to a different region enhances disaster recovery.

Under 'Copy settings from existing bucket', click 'Choose bucket' and select the source bucket (`appconfigprod1`). Then click 'Choose bucket'.

💡 This helps in pre-populating some settings, though specific replication rules are configured separately.

Leave the rest of the settings as defaults and click 'Create bucket'. (Ignore system tag warnings if they appear).

💡 Completes the destination bucket creation.

Click the source bucket (`appconfigprod1`) to open it. Navigate to the 'Management' tab.

💡 Replication rules are configured on the source bucket.

In the 'Replication rules' section, click 'Create replication rule'. Click 'Enable Bucket Versioning' if not already enabled.

💡 Versioning is a prerequisite for S3 replication.

Under 'Replication rule configuration', enter a 'Replication rule name' (e.g., `CrossRegion`). Under 'Source bucket', select 'Apply to all objects in the bucket'.

💡 Names the rule and defines its scope for replication.

Under 'Destination', leave 'Choose a bucket in this account' selected. Click 'Browse S3', select the newly created destination bucket (`appconfigprod2`), and click 'Choose path'. Also, click 'Enable bucket versioning' for the destination.

💡 Specifies the target for replicated objects and ensures versioning is active on the destination.

Under 'IAM role', click the dropdown and select 'Create new role'. Click 'Save'.

💡 An IAM role is required to grant S3 permissions to perform replication actions between buckets.

When prompted with the 'Replicate existing objects?' popup, choose 'No, do not replicate existing objects' and click 'Submit'.

💡 This lab focuses on new objects; existing objects can be replicated using S3 Batch Replication if needed.

Navigate to S3 in the AWS console. Click 'Create bucket'.

💡 Initiates the bucket creation process.

Create a 'Public Bucket': Set 'Bucket name' to `acg-testlab-public-<random>` (where `<random>` is a unique string). Select `US East (N. Virginia) us-east-1` for 'Region'. Under 'Object Ownership', select 'ACLs enabled' and 'Bucket owner preferred'. In 'Block Public Access settings', uncheck 'Block all public access' and acknowledge the warning. Leave other settings as defaults. Click 'Create bucket'.

💡 This configures the bucket to allow public access at a later stage for objects.

Create a 'Private Bucket': On the 'Buckets' screen, click 'Create bucket'. Set 'Bucket name' to `acg-testlab-private-<random>`. Select `US East (N. Virginia) us-east-1` for 'Region'. Leave other settings as defaults (Block Public Access should be enabled by default). Click 'Create bucket'.

💡 This bucket will remain private, demonstrating restricted access.

Upload a file to the Private Bucket: Select the private bucket. Click 'Upload', then 'Add files'. Upload `cat1.jpg`. Leave other settings as defaults and click 'Upload'. After success, click its name and open the 'Object URL' in a new tab to see an 'Access Denied' error. Note that 'Make public using ACL' is grayed out.

💡 Demonstrates that objects in a private bucket (without ACLs for public access) are inaccessible publicly.

Upload a file to the Public Bucket and make it public: Go back to 'Buckets' and select the public bucket. Click 'Upload', then 'Add files'. Upload `cat1.jpg`. Leave other settings as defaults and click 'Upload'. After success, click its name, open 'Object URL' (will show error), then select 'Object actions' > 'Make public using ACL', and click 'Make public'. Open 'Object URL' again; the image should load.

💡 Shows that even in a public-access-enabled bucket, individual objects need to be explicitly made public.

Enable Versioning on the Public Bucket: Back on the public bucket page, click the 'Properties' tab. In the 'Bucket Versioning' section, click 'Edit'. Click 'Enable' and 'Save changes'.

💡 Prepares the bucket to store multiple versions of objects.

Upload another image to test Versioning: Click the 'Objects' tab. Click 'Upload', 'Add files'. Rename `cat2.jpg` to `cat1.jpg`. Upload this newly renamed `cat1.jpg` image. Click 'Upload'. After success, click its name to view properties, then click the 'Versions' tab.

💡 Uploading a new file with the same name creates a new version, preserving the old one.

View the Image Versions: Select 'Object actions' > 'Make public using ACL' for the latest version and click 'Make public'. Open its 'Object URL' to see the new image. Then, on the 'Versions' tab, click the 'null' object (the original version). Open its 'Object URL' to see the original `cat1.jpg` image.

💡 Confirms that both versions of the object are retained and accessible via their unique version IDs.

Create an S3 bucket in the `us-east-1` region, ensuring its name begins with `my-bucket-` (e.g., `my-bucket-<ACCOUNT ID>`). When creating the bucket, uncheck all four S3 Block Public Access settings checkboxes to allow public access. If the bucket was created with public access blocked, go to `Bucket` > `Permissions` > `Public access settings` > `Edit` and uncheck all four restrictions.

💡 A globally unique bucket name is required. Disabling Block Public Access is critical to allow public read access for a static website.

aws s3 mb s3://saa-quiz-app-static

Upload your website content (e.g., `index.html` and `error.html`) to the S3 bucket. You can find sample code in the provided GitHub repository.

💡 This places the static files that constitute your website into the S3 bucket.

aws s3 cp data/question_bank.json s3://saa-quiz-app-static/data/
aws s3 cp web/static/ s3://saa-quiz-app-static/static/ --recursive

Enable Static Website Hosting: On the bucket's `Properties` tab, scroll to 'Static website hosting' and click 'Edit'. Select 'Enable', set 'Index document' to `index.html`, and 'Error document' to `error.html`. Save changes.

💡 This configures S3 to serve content as a website, specifying the default page and an error page.

Apply a Bucket Policy to make objects publicly readable: Go to `Bucket` > `Permissions` > `Bucket Policy`. Add a JSON statement that grants `s3:GetObject` permission to everyone (Principal: `*`). Ensure the `Resource` ARN ends with `/*` so the policy applies to all objects within the bucket.

💡 This policy grants the necessary read access for anonymous users to view your website content.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::saa-quiz-app-static/*"
    }
  ]
}