AWS

AWS Elastic Beanstalk – Platform as a Service

Elastic Beanstalk Environment Tiers
~ Last updated on : ~ jayendrapatil ~ 16 Comments

AWS Elastic Beanstalk

⚠️ Important Platform Update: Amazon Linux 2 End of Life – June 30, 2026

All Elastic Beanstalk platform branches based on Amazon Linux 2 (AL2) will be retired by June 30, 2026, when AL2 reaches End of Life. After this date, AWS will not release security updates, patches, or new packages for AL2-based platforms.

Action Required: Migrate to Amazon Linux 2023 (AL2023) platform branches before the retirement date. AL2023 is supported until June 2029. Migration requires a blue/green deployment as AL2 and AL2023 platform versions are incompatible.

Refer to Migration from Amazon Linux 2 to Amazon Linux 2023 for detailed guidance.

  • AWS Elastic Beanstalk helps to quickly deploy and manage applications in the AWS Cloud without having to worry about the infrastructure that runs those applications.
  • reduces management complexity without restricting choice or control.
  • enables automated infrastructure management and code deployment, by simply uploading, for applications and includes
    • Application platform management
    • Capacity provisioning
    • Load Balancing
    • Auto Scaling
    • Code deployment
    • Health Monitoring
  • Elastic Beanstalk automatically launches an environment once an application is uploaded, and creates and configures the AWS resources needed to run the code. After the environment is launched, it can be managed and used to deploy new application versions.
  • AWS resources launched by Elastic Beanstalk are fully accessible i.e. EC2 instances can be SSHed into.
  • provides developers and systems administrators with an easy, fast way to deploy and manage the applications without having to worry about AWS infrastructure.
  • supports applications developed in Go, Java, .NET, Node.js, PHP, Python, and Ruby, as well as Docker containers.
  • CloudFormation, using templates, is a better option than Elastic Beanstalk if the internal AWS resources to be used are known and fine-grained control is needed.

Elastic Beanstalk Supported Platforms

  • Elastic Beanstalk supports the following platforms on Amazon Linux 2023 (recommended) and Amazon Linux 2:
    • Docker
    • Go
    • Java SE
    • Tomcat
    • .NET Core on Linux
    • .NET on Windows Server
    • Node.js
    • PHP
    • Python
    • Ruby
  • Elastic Beanstalk supports AWS Graviton (arm64) instance types on Amazon Linux 2 and AL2023 platforms, providing up to 40% better price-performance over x86-based instances.
  • Amazon Linux 2023 is the recommended platform, offering enhanced security features including FIPS certification, modern package versions, and support until June 2029.

Elastic Beanstalk Components

Elastic Beanstalk Components

  • Application
    • An Application is a logical collection of components, including environments, versions, and environment configurations.
  • Application Version
    • An application version refers to a specific, labeled iteration of deployable code for a web application.
    • Applications can have many versions and each application version is unique and points to an S3 object.
    • Multiple versions of an Application can be deployed for testing differences and helps to roll back to any version in case of issues.
    • Elastic Beanstalk supports application version lifecycle policies to automatically delete old versions based on age or total count (up to 100 versions deleted per policy application).
  • Environment
    • An environment is a version that is deployed onto AWS resources.
    • An environment runs a single application version at a time, but same application version can be deployed across multiple environments.
    • When an environment is created, EB provisions the resources needed to run the specified application version.
  • Environment Configuration
    • An environment configuration identifies a collection of parameters and settings that define how an environment and its associated resources behave
    • When an environment’s configuration settings are updated, EB automatically applies the changes to existing resources or deletes and deploys new resources, depending upon the change
  • Configuration Template
    • A configuration template is a starting point for creating unique environment configurations

Elastic Beanstalk Architecture

Elastic Beanstalk Environment Tiers

  • Elastic Beanstalk environment requires an environment tier, platform, and
    environment type.
  • Environment tier determines whether EB provisions resources to support
    • Web tier – a web application that handles HTTP(S) requests
    • Worker tier – an application that handles background-processing tasks.
  • One environment cannot support two different environment tiers because each requires its own set of resources; a worker environment tier and a web server environment tier each require an Auto Scaling group, but Elastic Beanstalk supports only one Auto Scaling group per environment.

Web Environment Tier

  • An environment tier whose web application processes web requests is known as a web server tier.
  • AWS resources created for a web environment tier include an Elastic Load Balancer, an Auto Scaling group, one or more EC2 instances
  • Every Environment has a CNAME URL pointing to the ELB, aliased in Route 53 to ELB URL.
  • Elastic Beanstalk supports dual-stack (IPv4 and IPv6) configuration for Application Load Balancers and Network Load Balancers (not Classic Load Balancers or single-instance environments).
  • Each EC2 server instance that runs the application uses a container type, which defines the infrastructure topology and software stack.
  • A software component called the host manager (HM) runs on each EC2 server instance and is responsible for
    • Deploying the application
    • Aggregating events and metrics for retrieval via the console, the API, or the command line
    • Generating instance-level events
    • Monitoring the application log files for critical errors
    • Monitoring the application server
    • Patching instance components
    • Rotating your application’s log files and publishing them to S3

Worker Environment Tier

  • An environment tier whose web application runs background jobs is known as a worker tier.
  • AWS resources created for a worker environment tier include an Auto Scaling group, one or more EC2 instances, and an IAM role.
  • For the worker environment tier, Elastic Beanstalk also creates and provisions an SQS queue, if one doesn’t exist.
  • When a worker environment tier is launched, EB installs the necessary support files for the programming language of choice and a daemon on each EC2 instance in the Auto Scaling group reading from the same SQS queue.
  • Daemon is responsible for pulling requests from an SQS queue and then sending the data to the web application running in the worker environment tier that will process those messages.
  • Worker environments support SQS dead letter queues which can be used to store messages that could not be successfully processed. Dead letter queue provides the ability to sideline, isolate and analyze the unsuccessfully processed messages

Elastic Beanstalk Monitoring and Troubleshooting

Enhanced Health Reporting

  • Enhanced health reporting provides detailed health information about EC2 instances via a health agent installed in supported AMIs.
  • Reports environment and instance health every 10 seconds with color-coded status: Green (OK), Yellow (Warning), Red (Degraded/Severe).
  • Combines standard load balancer health checks with instance monitoring to ensure proper functioning.
  • Required for Managed Platform Updates and Traffic Splitting deployments.

AI-Powered Environment Analysis (New – 2026)

  • Elastic Beanstalk provides AI-powered analysis to identify root causes and recommend solutions for environment health issues.
  • Available when environment health status is Warning, Degraded, or Severe.
  • Collects environment events, health data, and instance logs (up to 170,000 tokens), sends them to Amazon Bedrock for analysis, and returns AI-generated insights and recommended solutions.
  • Available on AL2 and AL2023 platform versions released on or after February 26, 2026, and Windows Server platforms released on or after April 22, 2026.
  • Uses Amazon Nova as a fallback model for improved reliability.
  • Can be triggered via the console (AI Analysis button), AWS CLI (RequestEnvironmentInfo with analyze info type), or EB CLI (eb logs --analyze).
  • Requires instance profile permissions for Amazon Bedrock (bedrock:InvokeModel, bedrock:ListFoundationModels) and Elastic Beanstalk (elasticbeanstalk:DescribeEvents, elasticbeanstalk:DescribeEnvironmentHealth).
  • Standard Amazon Bedrock pricing applies for model invocations.

Deployment Logs (New – 2026)

  • Elastic Beanstalk now provides a Deployments tab in the environment dashboard with consolidated view of deployment history and real-time deployment progress with step-by-step logs.
  • Helps debug deployment failures without needing to manually request and download log bundles.
  • Available on AL2 and AL2023 platforms released on or after March 11, 2026, and Windows platforms released on or after April 22, 2026.

CloudWatch Logs Console Integration (New – 2026)

  • Elastic Beanstalk console now integrates CloudWatch Logs directly in the Logs tab, eliminating the need to navigate to the CloudWatch console separately.
  • Provides direct access to relevant log groups and log streams for the environment.

Managed Platform Updates

  • Elastic Beanstalk can be configured to automatically apply patch and minor updates to the platform during a scheduled maintenance window.
  • Managed updates require enhanced health reporting to be enabled.
  • Updates are applied using immutable deployments to ensure no impact to the running environment during the update process.
  • Helps maintain the shared responsibility model by keeping platform components up to date with security patches.
  • Supports tag propagation to launch templates for consistent resource tagging during managed updates.

Elastic Beanstalk with Other AWS Services

  • Elastic Beanstalk supports VPC and launches AWS resources, such as instances, into the VPC
  • Elastic Beanstalk supports IAM and helps you securely control access to your AWS resources.
  • CloudFront can be used to distribute the content in S3 after an Elastic Beanstalk is created and deployed
  • CloudTrail
    • Elastic Beanstalk is integrated with CloudTrail, a service that captures all of the Elastic Beanstalk API calls and delivers the log files to a specified S3 bucket.
    • CloudTrail captures API calls from the Elastic Beanstalk console or from your code to the Elastic Beanstalk APIs and helps to determine the request made to Elastic Beanstalk, the source IP address from which the request was made, who made the request, when it was made, etc.
  • RDS
    • EB provides support for running RDS instances in the environment which is ideal for development and testing but not for production.
    • For a production environment, it is not recommended because it ties the lifecycle of the database instance to the lifecycle of the application’s environment. So if the environment is deleted, the RDS instance is deleted as well
    • It is recommended to launch a database instance outside of the environment and configure the application to connect to it outside of the functionality provided by Elastic Beanstalk.
    • Using a database instance external to the environment requires additional security group and connection string configuration, but it also lets the application connect to the database from multiple environments, use database types not supported with integrated databases, perform blue/green deployments, and tear down the environment without affecting the database instance.
  • S3
    • EB creates an S3 bucket named elasticbeanstalk-region-account-id for each region in which environments are created.
    • EB uses the bucket to store application versions, logs, and other supporting files.
    • It applies a bucket policy to buckets it creates to allow environments to write to the bucket and prevent accidental deletion

Elastic Beanstalk Deployment Strategies

Elastic Beanstalk Deployment Methods

  • All at Once
    • performs an in-place deployment on all instances at the same time.
    • is performed on existing instances and would lead to downtime as well as time to roll back changes.
  • Rolling
    • splits the environment instances into batches and deploys the application’s new version on the existing instance one batch at a time, leaving the rest of the environment instances running the old version.
    • waits until all instances in a batch are healthy before moving on to the next batch.
    • reduces downtime as all instances are not updated and if the health checks fail the deployment can be rollback.
  • Rolling with an Additional batch
    • similar to Rolling however it starts the deployment of the application’s new version on a new batch.
    • does not impact the capacity and ensures full capacity during the deployment process.
  • Immutable
    • ensures the application source is always deployed to new instances.
    • prevent issues caused by partially completed rolling deployments.
    • provides minimal downtime and quick rollback.
  • Traffic Splitting
    • performs a canary testing as part of the application deployment.
    • launches a full set of new instances (like immutable deployment) and forwards a configurable percentage of client traffic to the new version for a specified evaluation period.
    • monitors the health of the new instances during the evaluation period.
    • if the new instances remain healthy, shifts all traffic to them and terminates the old ones.
    • if issues are detected, triggers an automatic rollback by shifting traffic back to the original instances.
    • ideal for production deployments where you want to validate with real traffic before full cutover.
  • Blue Green
    • suitable for deployments that depend on incompatible resource configuration changes or a new version that can’t run alongside the old version.
    • implemented using the Swap Environment URLs feature that entails a DNS switchover.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. An organization is planning to use AWS for their production roll out. The organization wants to implement automation for deployment such that it will automatically create a LAMP stack, download the latest PHP installable from S3 and setup the ELB. Which of the below mentioned AWS services meets the requirement for making an orderly deployment of the software?
    1. AWS Elastic Beanstalk
    2. AWS CloudFront
    3. AWS CloudFormation
    4. AWS DevOps
  2. What does Amazon Elastic Beanstalk provide?
    1. A scalable storage appliance on top of Amazon Web Services.
    2. An application container on top of Amazon Web Services
    3. A service by this name doesn’t exist.
    4. A scalable cluster of EC2 instances
  3. You want to have multiple versions of your application running at the same time, with all versions launched via AWS Elastic Beanstalk. Is this possible?
    1. However if you have 2 AWS accounts this can be done
    2. AWS Elastic Beanstalk is not designed to support multiple running environments
    3. AWS Elastic Beanstalk is designed to support a number of multiple running environments
    4. However AWS Elastic Beanstalk is designed to support only 2 multiple running environments
  4. A .NET application that you manage is running in Elastic Beanstalk. Your developers tell you they will need access to application log files to debug issues that arise. The infrastructure will scale up and down. How can you ensure the developers will be able to access only the log files?
    1. Access the log files directly from Elastic Beanstalk
    2. Enable log file rotation to S3 within the Elastic Beanstalk configuration
    3. Ask your developers to enable log file rotation in the applications web.config file
    4. Connect to each Instance launched by Elastic Beanstalk and create a Windows Scheduled task to rotate the log files to S3
  5. Your team has a tomcat-based Java application you need to deploy into development, test and production environments. After some research, you opt to use Elastic Beanstalk due to its tight integration with your developer tools and RDS due to its ease of management. Your QA team lead points out that you need to roll a sanitized set of production data into your environment on a nightly basis. Similarly, other software teams in your org want access to that same restored data via their EC2 instances in your VPC .The optimal setup for persistence and security that meets the above requirements would be the following. [PROFESSIONAL]
    1. Create your RDS instance as part of your Elastic Beanstalk definition and alter its security group to allow access to it from hosts in your application subnets. (Not optimal for persistence as the RDS is associated with the Elastic Beanstalk lifecycle and would not live independently)
    2. Create your RDS instance separately and add its IP address to your application’s DB connection strings in your code. Alter its security group to allow access to it from hosts within your VPC’s IP address block. (RDS is connected using DNS endpoint only)
    3. Create your RDS instance separately and pass its DNS name to your app’s DB connection string as an environment variable. Create a security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself. (Security group allows instances to access the RDS with new instances launched without any changes)
    4. Create your RDS instance separately and pass its DNS name to your DB connection string as an environment variable. Alter its security group to allow access to it from hosts in your application subnets. (Not optimal for security adding individual hosts)
  6. Your must architect the migration of a web application to AWS. The application consists of Linux web servers running a custom web server. You are required to save the logs generated from the application to a durable location. What options could you select to migrate the application to AWS? (Choose 2) [PROFESSIONAL]
    1. Create an AWS Elastic Beanstalk application using the custom web server platform. Specify the web server executable and the application project and source files. Enable log file rotation to Amazon Simple Storage Service (S3). (EB does not work with Custom server executable)
    2. Create Dockerfile for the application. Create an AWS OpsWorks stack consisting of a custom layer. Create custom recipes to install Docker and to deploy your Docker container using the Dockerfile. Create custom recipes to install and configure the application to publish the logs to Amazon CloudWatch Logs (⚠️ Note: AWS OpsWorks Stacks reached End of Life on May 26, 2024 and is no longer available. This option is no longer valid for new implementations.)
    3. Create Dockerfile for the application. Create an AWS OpsWorks stack consisting of a Docker layer that uses the Dockerfile. Create custom recipes to install and configure Amazon Kinesis to publish the logs into Amazon CloudWatch. (Kinesis not needed. ⚠️ Note: AWS OpsWorks Stacks reached End of Life on May 26, 2024.)
    4. Create a Dockerfile for the application. Create an AWS Elastic Beanstalk application using the Docker platform and the Dockerfile. Enable logging the Docker configuration to automatically publish the application logs. Enable log file rotation to Amazon S3. (Use Docker configuration with awslogs and EB with Docker)
    5. Use VM import/Export to import a virtual machine image of the server into AWS as an AMI. Create an Amazon Elastic Compute Cloud (EC2) instance from AMI, and install and configure the Amazon CloudWatch Logs agent. Create a new AMI from the instance. Create an AWS Elastic Beanstalk application using the AMI platform and the new AMI. (Use VM Import/Export to create AMI and CloudWatch logs agent to log)
  7. Which of the following groups is AWS Elastic Beanstalk best suited for?
    1. Those who want to deploy and manage their applications within minutes in the AWS cloud.
    2. Those who want to privately store and manage Git repositories in the AWS cloud.
    3. Those who want to automate the deployment of applications to instances and to update the applications as required.
    4. Those who want to model, visualize, and automate the steps required to release software.
  8. When thinking of AWS Elastic Beanstalk’s model, which is true?
    1. Applications have many deployments, deployments have many environments.
    2. Environments have many applications, applications have many deployments.
    3. Applications have many environments, environments have many deployments. (Applications group logical services. Environments belong to Applications, and typically represent different deployment levels (dev, stage, prod, forth). Deployments belong to environments, and are pushes of bundles of code for the environments to run.)
    4. Deployments have many environments, environments have many applications.
  9. If you’re trying to configure an AWS Elastic Beanstalk worker tier for easy debugging if there are problems finishing queue jobs, what should you configure?
    1. Configure Rolling Deployments.
    2. Configure Enhanced Health Reporting
    3. Configure Blue-Green Deployments.
    4. Configure a Dead Letter Queue (Elastic Beanstalk worker environments support SQS dead letter queues, where worker can send messages that for some reason could not be successfully processed. Dead letter queue provides the ability to sideline, isolate and analyze the unsuccessfully processed messages. Refer link)
  10. When thinking of AWS Elastic Beanstalk, which statement is true?
    1. Worker tiers pull jobs from SNS.
    2. Worker tiers pull jobs from HTTP.
    3. Worker tiers pull jobs from JSON.
    4. Worker tiers pull jobs from SQS. (Elastic Beanstalk installs a daemon on each EC2 instance in the Auto Scaling group to process SQS messages in the worker environment. Refer link)
  11. You are building a Ruby on Rails application for internal, non-production use, which uses MySQL as a database. You want developers without very much AWS experience to be able to deploy new code with a single command line push. You also want to set this up as simply as possible. Which tool is ideal for this setup?
    1. AWS CloudFormation
    2. AWS OpsWorks (⚠️ OpsWorks Stacks reached EOL May 26, 2024)
    3. AWS ELB + EC2 with CLI Push
    4. AWS Elastic Beanstalk
  12. What AWS products and features can be deployed by Elastic Beanstalk? Choose 3 answers.
    1. Auto scaling groups
    2. Route 53 hosted zones
    3. Elastic Load Balancers
    4. RDS Instances
    5. Elastic IP addresses
    6. SQS Queues
  13. AWS Elastic Beanstalk stores your application files and optionally server log files in ____.
    1. Amazon Storage Gateway
    2. Amazon Glacier
    3. Amazon EC2
    4. Amazon S3
  14. When you use the AWS Elastic Beanstalk console to deploy a new application ____.
    1. Need to upload each file separately
    2. Need to create each file and path
    3. Need to upload a source bundle
    4. Need to create each file
  15. A company wants to deploy a new application version to production using Elastic Beanstalk. They need to validate the new version with a small percentage of real production traffic before completing the full deployment. Which deployment policy should they use?
    1. Immutable
    2. Rolling with additional batch
    3. Traffic splitting (Traffic splitting performs canary testing by forwarding a configurable percentage of traffic to new instances for an evaluation period, with automatic rollback on failure)
    4. Blue/Green
  16. An application running on Elastic Beanstalk is experiencing health issues. The team needs to quickly identify the root cause and get recommended solutions without manually analyzing logs. Which Elastic Beanstalk feature should they use?
    1. Enhanced Health Reporting
    2. CloudWatch Alarms
    3. AI-powered environment analysis (AI-powered analysis uses Amazon Bedrock to analyze environment events, health data, and logs, then provides AI-generated root cause analysis and recommended solutions)
    4. X-Ray tracing
  17. Which Elastic Beanstalk feature automatically applies patch and minor platform updates during a maintenance window?
    1. Rolling updates
    2. Immutable deployments
    3. Managed platform updates (Managed platform updates automatically apply patch and minor updates using immutable deployments during a scheduled maintenance window. Requires enhanced health reporting to be enabled.)
    4. Blue/Green deployments

References

EFS vs EBS Multi-Attach – When to Use Shared Storage on AWS

~ Last updated on : ~ jayendrapatil

AWS EFS vs EBS Multi-Attach

AWS EFS vs EBS Multi-Attach

📝 Post Updated – June 2026

This post has been updated to reflect the latest EFS and EBS enhancements including EFS Archive storage class, Elastic Throughput performance improvements (up to 20 GiB/s read), EBS io2 Block Express with NVMe Reservations for Multi-Attach, and cross-account replication support.

EFS vs EBS Multi-Attach features

  • Elastic File System – EFS is a fully managed, serverless file storage service for use with Amazon compute (EC2, containers, serverless) and on-premises servers. EFS provides a file system interface, file system access semantics (such as strong consistency and file locking), and concurrently accessible storage for up to thousands of EC2 instances.
  • Elastic Block Store – EBS is a block-level storage service for use with EC2. EBS can deliver performance for workloads that require the lowest-latency access to data from a single EC2 instance. EBS Multi-Attach is supported on Provisioned IOPS SSD volumes (io1 and io2) for concurrent access from multiple instances.
  • Service type
    • Elastic File System is fully managed and serverless — automatically scales storage capacity up or down.
    • EBS needs to be managed by the user — requires provisioning capacity upfront.
  • Accessibility
    • EFS can be accessed concurrently from all AZs in the Region via mount targets. Also supports cross-Region and cross-account replication (Nov 2024).
    • EBS Multi-Attach can be accessed concurrently from instances within the same AZ only.
  • Data Scalability
    • EFS provides virtually unlimited data storage — scales automatically to petabytes.
    • EBS Multi-Attach has limits on the storage it can provide (io2 Block Express supports up to 64 TiB per volume).
  • Instance Scalability
    • EFS can be attached to tens, hundreds, or even thousands of compute instances concurrently.
    • EBS Multi-Attach enabled volumes can be attached to up to 16 Linux instances built on the Nitro System.
  • Supported Instances
    • EFS is compatible with all Linux-based AMIs for EC2, uses NFS v4.1 protocol (POSIX-compliant). EFS is not supported on Windows instances.
    • Multi-Attach enabled volumes can be attached to up to 16 instances built on the Nitro System that are in the same AZ. With NVMe Reservations (io2 volumes, Sept 2023), Multi-Attach now supports Windows Server Failover Clusters with I/O fencing for safe write access coordination.
  • Storage Classes
    • EFS offers four storage classes: Standard, Standard-IA (Infrequent Access), One Zone, and One Zone-IA. Additionally, EFS Archive (launched Nov 2023) provides up to 72% lower cost than EFS IA for rarely accessed data with automatic intelligent tiering.
    • EBS Multi-Attach is supported on Provisioned IOPS SSD volumes — io1 and io2 (including io2 Block Express).
  • Performance
    • EFS with Elastic Throughput supports up to 20 GiB/s read throughput and 5 GiB/s write throughput (March 2024 update), with up to 1.5 GiB/s per client (May 2024 update). Supports sub-millisecond latency for Standard storage class.
    • EBS io2 Block Express delivers sub-millisecond latency with up to 256,000 IOPS, 4,000 MB/s throughput per volume.
  • I/O Fencing & Coordination
    • EFS handles file locking and consistency natively via NFS protocol semantics.
    • EBS Multi-Attach with io2 volumes supports NVMe Reservations (Sept 2023), enabling I/O fencing for safe write access coordination across cluster nodes — critical for Windows Server Failover Clusters and clustered databases.
  • Data Protection
    • EFS supports replication (cross-Region and cross-account), AWS Backup integration, and lifecycle management with automatic tiering.
    • EBS supports snapshots, Amazon Data Lifecycle Manager for automated snapshot management, and volume-level encryption.
  • Pricing
    • EFS is priced as per the pay-as-you-use model — only pay for storage consumed.
    • EBS is priced as per the provisioned capacity — pay for allocated storage even if unused.

Recent Updates (2023-2025)

Amazon EFS Updates

  • EFS Archive Storage Class (Nov 2023) – New lowest-cost storage class offering up to 72% lower cost than EFS Infrequent Access for rarely accessed data. Supports automatic intelligent tiering from Standard → IA → Archive.
  • Elastic Throughput – 20 GiB/s (March 2024) – Maximum throughput doubled to 20 GiB/s read (from 10 GiB/s) and 5 GiB/s write (from 3 GiB/s).
  • Per-client Throughput – 1.5 GiB/s (May 2024) – Maximum per-client throughput tripled to 1.5 GiB/s (from 500 MiB/s).
  • Cross-account Replication (Nov 2024) – EFS now supports replicating file systems between AWS accounts for enhanced disaster recovery.
  • 10,000 Access Points per File System (Feb 2025) – Limit increased 10x from 1,000 to 10,000 access points per file system for container and serverless workloads.

Amazon EBS Multi-Attach Updates

  • NVMe Reservations for io2 (Sept 2023) – Enables I/O fencing for Multi-Attach volumes, providing safe write access coordination across cluster nodes. Enabled by default for all Multi-Attach io2 volumes created after September 18, 2023.
  • Windows Server Failover Cluster Support – With NVMe Reservations, EBS Multi-Attach io2 volumes now support Windows Server Failover Clusters (WSFC) with proper I/O fencing, enabling SQL Server Failover Cluster Instances.
  • io2 Block Express Performance – Delivers up to 256,000 IOPS, 4,000 MB/s throughput, 64 TiB capacity per volume with 99.999% durability and sub-millisecond latency.
  • Expanded Instance Type Support (2025) – Multi-Attach support expanded to additional Nitro-based instance types.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A company wants to organize the contents of multiple websites in managed file storage. The company must be able to scale the storage based on demand without needing to provision storage. Multiple servers across multiple Availability Zones within a region should be able to access this storage concurrently. Which services should the Solutions Architect recommend?
    1. Amazon S3
    2. Amazon EBS Multi-Attach
    3. Amazon EFS
    4. AWS Storage Gateway – Volume gateway
  2. A company requires shared block storage for a clustered database running on multiple EC2 instances within the same Availability Zone. The solution must support I/O fencing to prevent data corruption during failover scenarios. Which solution meets these requirements?
    1. Amazon EFS with General Purpose performance mode
    2. Amazon EBS io2 Multi-Attach with NVMe Reservations
    3. Amazon EBS gp3 with Multi-Attach enabled
    4. Amazon FSx for Windows File Server
  3. A company needs to store large amounts of rarely accessed files that still need to be part of the same file system namespace as their frequently accessed data. The solution must minimize costs while maintaining immediate access when needed. Which storage configuration is MOST cost-effective?
    1. Amazon S3 Glacier Instant Retrieval
    2. Amazon EFS with Standard storage class only
    3. Amazon EFS with lifecycle management using Standard, Infrequent Access, and Archive storage classes
    4. Amazon EBS with Cold HDD (sc1) volumes
  4. A company wants to deploy a Windows Server Failover Cluster on AWS for a SQL Server Always On Failover Cluster Instance. The shared storage must support concurrent access from multiple instances with proper write coordination. Which solution meets these requirements?
    1. Amazon EFS mounted on Windows instances
    2. Amazon EBS gp3 with Multi-Attach
    3. Amazon EBS io2 Multi-Attach with NVMe Reservations
    4. Amazon S3 with S3 File Gateway
  5. A media company runs a video processing workload across hundreds of EC2 instances that need to read and write to a shared file system. The workload requires up to 15 GiB/s of read throughput during peak hours. Which storage solution meets these requirements? (Select TWO)
    1. Amazon EFS with Elastic Throughput mode
    2. Amazon EBS io2 with Multi-Attach
    3. Amazon S3 with S3 Transfer Acceleration
    4. Amazon EFS Regional file system with General Purpose performance mode
    5. Amazon FSx for Lustre

📖 Related: AWS S3 vs EBS vs EFS – Complete Storage Comparison Guide

References

AWS S3 Security

~ Last updated on : ~ jayendrapatil

AWS S3 Security

📌 Last Updated: June 2026. This post reflects the latest S3 security features including default SSE-S3 encryption, SSE-C disabled by default (April 2026), S3 Access Grants, ABAC for S3 buckets, Resource Control Policies (RCPs), and DSSE-KMS dual-layer encryption.

  • AWS S3 Security is a shared responsibility between AWS and the Customer
  • S3 is a fully managed service that is protected by the AWS global network security procedures
  • AWS handles basic security tasks like guest operating system (OS) and database patching, firewall configuration, and disaster recovery.
  • Security and compliance of S3 are assessed by third-party auditors as part of multiple AWS compliance programs including SOC, PCI DSS, HIPAA, etc.
  • S3 provides several other features to handle security, which are the customers’ responsibility.
  • S3 Encryption supports both data at rest and data in transit encryption.
    • Data in transit encryption can be provided by enabling communication via SSL/TLS or using client-side encryption
    • Data at rest encryption can be provided using Server Side or Client Side encryption
    • All new objects are automatically encrypted with SSE-S3 by default (since January 2023)
    • SSE-C is disabled by default on all new general purpose buckets (since April 2026)
  • S3 permissions can be handled using
    • IAM User Policies
    • Resource-based policies which include Bucket policies (ACLs are now disabled by default)
    • S3 Access Points
    • S3 Access Grants – scalable access control mapping corporate identities to S3 data
    • Attribute-Based Access Control (ABAC) – tag-based authorization for S3 buckets (Nov 2025)
  • S3 Object Lock helps to store objects using a WORM model and can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely.
  • S3 Access Points simplify data access for any AWS service or customer application that stores data in S3.
  • S3 Versioning with MFA Delete can be enabled on a bucket to ensure that data in the bucket cannot be accidentally overwritten or deleted.
  • S3 Block Public Access provides controls across an entire AWS Account or at the individual S3 bucket level to ensure that objects never have public access, now and in the future.
  • S3 Access Analyzer monitors the access policies, ensuring that the policies provide only the intended access to your S3 resources.
  • S3 Object Ownership – by default set to Bucket owner enforced, disabling ACLs on all new buckets.
  • Resource Control Policies (RCPs) – centrally restrict external access to S3 resources across an organization (Nov 2024).

S3 Encryption

  • S3 allows the protection of data in transit by enabling communication via SSL/TLS or using client-side encryption
  • All new objects uploaded to S3 are automatically encrypted at rest with SSE-S3 by default (since January 5, 2023). This applies to all buckets at no additional cost.
  • SSE-C (Server-Side Encryption with Customer-Provided Keys) is disabled by default on all new general purpose buckets since April 2026. Applications that need SSE-C must explicitly enable it using the PutBucketEncryption API after bucket creation.
  • S3 provides data-at-rest encryption using
    • Server-Side Encryption: S3 handles the encryption
      • SSE-S3
        • S3 handles the encryption and decryption using S3 managed keys
        • This is now the base level of encryption for every bucket in S3 (default)
      • SSE-KMS
        • S3 handles the encryption and decryption using keys managed through AWS KMS.
        • Provides additional audit trail via AWS CloudTrail for key usage
      • DSSE-KMS (Dual-Layer Server-Side Encryption)
        • Applies two layers of encryption using AWS KMS keys
        • Even if one encryption layer were compromised, data remains protected by the second layer
        • Designed for highly regulated workloads requiring CNSSP 15 compliance
        • Higher cost due to increased processing overhead and additional KMS API calls
      • SSE-C
        • S3 handles the encryption and decryption using keys managed and provided by the Customer.
        • Disabled by default on new buckets since April 2026 — must be explicitly enabled via PutBucketEncryption API
        • Most modern use cases prefer SSE-S3 or SSE-KMS for greater flexibility
    • Client Side Encryption: Customer handles the encryption
      • CSE-KMS
        • Customer handles the encryption and decryption using keys managed through AWS KMS.
      • Client-side Master Key
        • Customer handles the encryption and decryption using keys managed by them.

S3 Permissions

Refer blog post @ S3 Permissions

S3 Object Ownership

  • S3 Object Ownership is a bucket-level setting to control ownership of objects uploaded to a bucket and to disable or enable ACLs.
  • By default, Object Ownership is set to Bucket owner enforced, and all ACLs are disabled.
  • When ACLs are disabled, the bucket owner owns all the objects in the bucket and manages access exclusively using access-management policies.
  • A majority of modern use cases in S3 no longer require the use of ACLs.
  • Object Ownership has three settings:
    • Bucket owner enforced (default) – ACLs are disabled. The bucket owner automatically owns and has full control over every object. Policies define access control.
    • Bucket owner preferred – The bucket owner owns new objects written by other accounts if uploaded with the bucket-owner-full-control canned ACL.
    • Object writer – The uploading account owns the object. ACLs are enabled.
  • With ACLs disabled, you can use policies to control access to all objects in your bucket, regardless of who uploaded them.

S3 Object Lock

  • S3 Object Lock helps to store objects using a write-once-read-many (WORM) model.
  • can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely.
  • can help meet regulatory requirements that require WORM storage or add an extra layer of protection against object changes and deletion.
  • can be enabled only for new buckets and works only in versioned buckets.
  • provides two retention modes that apply different levels of protection to the objects
    • Governance mode
      • Users can’t overwrite or delete an object version or alter its lock settings unless they have special permissions.
      • Objects can be protected from being deleted by most users, but some users can be granted permission to alter the retention settings or delete the object if necessary.
      • Can be used to test retention-period settings before creating a compliance-mode retention period.
    • Compliance mode
      • A protected object version can’t be overwritten or deleted by any user, including the root user in the AWS account.
      • Object retention mode can’t be changed, and its retention period can’t be shortened.
      • Object versions can’t be overwritten or deleted for the duration of the retention period.
  • Legal Hold
    • Provides the same protection as a retention period, but has no expiration date.
    • Remains in place until explicitly removed.
    • Can be applied to any object in an Object Lock-enabled bucket, whether or not that object has a retention period.
    • Requires the s3:PutObjectLegalHold permission to add or remove.

S3 Access Points

  • S3 access points simplify data access for any AWS service or customer application that stores data in S3.
  • Access points are named network endpoints that are attached to buckets and can be used to perform S3 object operations, such as GetObject and PutObject.
  • Each access point has distinct permissions and network controls that S3 applies for any request that is made through that access point.
  • Each access point enforces a customized access point policy that works in conjunction with the bucket policy, attached to the underlying bucket.
  • An access point can be configured to accept requests only from a VPC to restrict S3 data access to a private network.
  • Custom block public access settings can be configured for each access point.
  • S3 Access Points now support tags for ABAC (Aug 2025), enabling tag-based permissions for access points.
  • S3 Multi-Region Access Points provide a global endpoint for applications to fulfill requests from S3 buckets in multiple AWS Regions.
    • Uses AWS Global Accelerator for intelligent routing to the nearest bucket
    • Supports failover controls for active-passive or active-active configurations
    • Does not support anonymous requests

S3 Access Grants

  • S3 Access Grants is a scalable access control solution that maps identities to S3 data permissions.
  • Acts as a credential vendor — users request credentials from S3 Access Grants, which evaluates grants and vends temporary, least-privilege access credentials.
  • Supports mapping identities from corporate directories such as Microsoft Entra ID (formerly Azure AD), Okta, and other IdPs via AWS IAM Identity Center.
  • Supports up to 100,000 grants per Region per account.
  • Ideal for complex access control requirements:
    • Bucket policy size limit (20 KB) exceeded
    • Human identities from external IdPs need S3 access for analytics and big data
    • Cross-account access without frequent IAM policy updates
    • Object-level access control for unstructured data
  • Integrates with AWS machine learning and analytics services including Amazon SageMaker, Amazon Redshift, and AWS Glue.
  • Simplifies authentication when using both IAM and Identity Provider permissions (March 2025).

S3 Attribute-Based Access Control (ABAC)

  • Launched November 2025 – Tag-based authorization for S3 general purpose buckets.
  • Enables automatically managing permissions for users and roles by controlling data access through tags on S3 buckets.
  • Instead of managing permissions individually, use tag-based IAM or bucket policies to grant or deny access based on matching tags between principals and buckets.
  • Makes it easy to grant S3 access based on project, team, cost center, data classification, or other bucket attributes instead of bucket names.
  • ABAC must be explicitly enabled on each S3 bucket using the PutBucketAbac API.
  • Tag-based condition keys work in AWS Organizations policies, IAM policies, and S3 bucket policies.
  • Can enforce tagging requirements at bucket creation using SCPs or IAM policies with aws:TagKeys and aws:RequestTag condition keys.
  • Same tags can serve dual purpose: access control (ABAC) and cost allocation.
  • Available through Console, API, SDKs, CLI, and CloudFormation at no additional cost.
  • Also supported on S3 directory buckets, S3 access points, and S3 tables buckets.

S3 VPC Gateway Endpoint

  • A VPC endpoint enables connections between a VPC and supported services, without requiring that you use an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
  • VPC is not exposed to the public internet.
  • A Gateway Endpoint is a gateway that is a target for a route in your route table used for traffic destined to either S3.

S3 Block Public Access

  • S3 Block Public Access provides controls across an entire AWS Account or at the individual S3 bucket level to ensure that objects never have public access, now and in the future.
  • S3 Block Public Access provides settings for access points, buckets, and accounts to help manage public access to S3 resources.
  • By default, new buckets, access points, and objects don’t allow public access. However, users can modify bucket policies, access point policies, or object permissions to allow public access.
  • S3 Block Public Access settings override these policies and permissions so that public access to these resources can be limited.
  • S3 Block Public Access allows account administrators and bucket owners to easily set up centralized controls to limit public access to their S3 resources that are enforced regardless of how the resources are created.
  • S3 doesn’t support block public access settings on a per-object basis.
  • S3 Block Public Access settings when applied to an account apply to all AWS Regions globally.

Resource Control Policies (RCPs)

  • Launched November 2024 – A new type of authorization policy in AWS Organizations for centrally restricting access to AWS resources.
  • RCPs work alongside Service Control Policies (SCPs) to establish permissions guardrails across multiple accounts in an organization.
  • Can enforce that S3 buckets in your accounts are only accessible by principals belonging to your organization.
  • Resource-based — they restrict what actions can be taken on resources regardless of the identity-based permissions granted.
  • Do not grant access — they only set the maximum available permissions on resources.
  • Key S3 use case: Restrict access to S3 buckets so no principal outside the organization can access them, regardless of individual S3 bucket policies.
  • Available in AWS GovCloud (US) Regions since May 2025.
  • Supported by AWS Control Tower with configurable managed controls.

S3 Access Analyzer

  • S3 Access Analyzer (part of IAM Access Analyzer) monitors the access policies, ensuring that the policies provide only the intended access to your S3 resources.
  • Evaluates bucket access policies and enables you to discover and swiftly remediate buckets with potentially unintended access.
  • External Access Findings — identifies resources accessible by principals outside your account or organization.
  • Internal Access Findings (June 2025) — identifies who within your AWS organization has access to critical resources including S3 buckets.
    • Monitors selected resources daily and surfaces findings in a unified dashboard
    • Combines internal and external access findings for a 360-degree view
  • Unused Access Analysis — identifies unused roles, access keys, and permissions to help achieve least privilege.
  • Custom Policy Checks — validate policies before deployment, including:
    • Check No Public Access (Jul 2024)
    • Check Access Not Granted
    • Guided revocation for unused access (Jun 2024)
  • Can be integrated into CI/CD pipelines for automated policy reviews.

S3 Security Best Practices

S3 Preventative Security Best Practices

  • Ensure S3 buckets use the correct policies and are not publicly accessible
    • Use S3 block public access
    • Keep ACLs disabled (Bucket owner enforced) unless specifically needed
    • Use AWS Trusted Advisor to inspect the S3 implementation.
    • Use Resource Control Policies (RCPs) to restrict access to organization principals only
  • Implement least privilege access
    • Use S3 Access Grants for complex identity-based access at scale
    • Use ABAC for tag-based authorization to simplify policy management
    • Use IAM Access Analyzer to identify and remediate overly permissive policies
  • Use IAM roles for applications and AWS services that require S3 access
  • Enable Multi-factor authentication (MFA) Delete to help prevent accidental bucket deletions
  • Consider Data at Rest Encryption
    • SSE-S3 is now applied by default to all new objects
    • Use SSE-KMS for additional audit trails and key management
    • Use DSSE-KMS for compliance requiring two independent layers of encryption
  • Enforce Data in Transit Encryption
  • Consider S3 Object Lock to store objects using a “Write Once Read Many” (WORM) model.
  • Enable versioning to easily recover from both unintended user actions and application failures.
  • Consider S3 Cross-Region replication
  • Consider VPC endpoints for S3 access to provide private S3 connectivity and help prevent traffic from potentially traversing the open internet.
  • Secure presigned URLs with short expiration times, IP restrictions, and scoped IAM permissions.

S3 Monitoring and Auditing Best Practices

  • Identify and Audit all S3 buckets to have visibility of all the S3 resources to assess their security posture and take action on potential areas of weakness.
  • Implement monitoring using AWS monitoring tools
  • Enable S3 server access logging, which provides detailed records of the requests that are made to a bucket useful for security and access audits
  • Use AWS CloudTrail, which provides a record of actions taken by a user, a role, or an AWS service in S3.
  • Enable AWS Config, which enables you to assess, audit, and evaluate the configurations of the AWS resources
  • Use Amazon Macie with S3 to automatically discover, classify, and protect sensitive data in AWS.
    • Automated sensitive data discovery continuously samples and analyzes objects
    • Provides sensitivity scores for each bucket
    • Builds interactive data maps showing sensitive data distribution across accounts
  • Use IAM Access Analyzer to monitor both external and internal access to S3 resources
  • Monitor AWS security advisories to regularly check security advisories posted in Trusted Advisor for the AWS account.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A company needs to ensure all objects stored in their S3 buckets are encrypted with a dual-layer encryption mechanism for CNSSP 15 compliance. Which encryption option should they use?
    1. SSE-S3
    2. SSE-KMS
    3. DSSE-KMS
    4. SSE-C
    Show Answer

    Answer: c. DSSE-KMS – Dual-Layer Server-Side Encryption with AWS KMS keys provides two independent layers of encryption for compliance requirements like CNSSP 15.

  2. An organization wants to grant access to S3 buckets based on team membership from their Microsoft Entra ID directory, supporting up to 50,000 data scientists. Which S3 feature is most appropriate?
    1. S3 Bucket Policies
    2. S3 Access Points
    3. S3 Access Grants
    4. S3 ACLs
    Show Answer

    Answer: c. S3 Access Grants – Maps corporate directory identities to S3 data permissions at scale (up to 100,000 grants per Region), ideal for large organizations with external IdPs.

  3. A security engineer needs to ensure that no S3 buckets in any account of the organization can be accessed by principals outside the organization, regardless of individual bucket policies. Which feature should they implement?
    1. S3 Block Public Access
    2. Service Control Policies (SCPs)
    3. Resource Control Policies (RCPs)
    4. S3 Bucket Policies with Deny statements
    Show Answer

    Answer: c. Resource Control Policies (RCPs) – RCPs centrally restrict external access to AWS resources across an organization, enforcing that S3 buckets are accessible only by principals belonging to the organization.

  4. An administrator wants to simplify S3 bucket access management by automatically granting access based on environment tags (dev, staging, prod) rather than maintaining individual bucket ARNs in policies. What feature should they use?
    1. S3 Access Grants
    2. S3 ABAC (Attribute-Based Access Control)
    3. S3 Access Points
    4. AWS Organizations SCPs
    Show Answer

    Answer: b. S3 ABAC – Enables tag-based authorization for S3 buckets, allowing access decisions based on matching tags between principals and buckets rather than individual bucket names.

  5. A company creates a new S3 bucket and attempts to upload objects using SSE-C encryption but receives an AccessDenied error. What is the most likely cause? (Choose the best answer)
    1. The IAM user lacks encryption permissions
    2. SSE-C is disabled by default on new buckets since April 2026
    3. The bucket policy blocks encryption operations
    4. KMS key permissions are missing
    Show Answer

    Answer: b – Since April 2026, SSE-C is disabled by default on all new general purpose buckets. Applications must explicitly enable SSE-C via the PutBucketEncryption API.

  6. Which IAM Access Analyzer feature, launched in June 2025, helps security teams identify who within their AWS organization has access to critical resources like S3 buckets?
    1. External Access Findings
    2. Internal Access Findings
    3. Unused Access Analysis
    4. Custom Policy Checks
    Show Answer

    Answer: b. Internal Access Findings – Monitors resources daily and provides a unified dashboard combining internal and external access findings for a 360-degree view.

References

AWS Backup

~ Last updated on : ~ jayendrapatil

AWS Backup

  • AWS Backup is a fully-managed service that helps centralize and automate data protection across AWS services, in the cloud, and on premises.
  • helps configure backup policies and monitor activity for the AWS resources in one place.
  • helps automate and consolidate backup tasks previously performed service-by-service and removes the need to create custom scripts and manual processes.
  • helps create backup policies called backup plans that help define the backup requirements like frequency, window, retention period, etc.
  • automatically backs up the AWS resources according to the defined backup plan.
  • can apply backup plans to the AWS resources by simply tagging them.
  • stores the periodic backups incrementally which provides benefit from the data protection of frequent backups while minimizing storage costs.
  • provides ransomware detection and recovery capabilities, and compliance insights and analytics for data protection policies and operations.
  • integrates with AWS Organizations to centrally deploy data protection policies across multiple accounts.

AWS Backup Features

  • Centralized Backup Management
    • provides a centralized backup console, APIs, and CLI to manage backups across all supported AWS services.
    • offers a consolidated view of backups and backup activity logs for auditing and compliance.
  • Policy-based Backup (Backup Plans)
    • Backup plans define backup requirements including schedule, window, retention, and lifecycle.
    • supports predefined backup schedules based on common best practices or custom schedules.
    • provides schedule preview that shows the next ten scheduled backup runs to validate schedules.
  • Tag-based Resource Assignment
    • can apply backup plans to AWS resources using tags for consistent and scalable protection.
    • supports assignment by resource ID, tags, or all resources of a specific type.
  • Lifecycle Management
    • supports automatic transition of backups from warm storage to cold storage to minimize costs.
    • supports a low-cost warm storage tier for Amazon S3 backup data (up to 30% cost reduction).
    • supports Amazon FSx Intelligent-Tiering for automatic cost optimization.
    • lifecycle policies automatically expire backups based on defined retention periods.
  • Cross-Region Backup
    • allows copying backups to multiple AWS Regions on demand or as part of a scheduled backup plan.
    • supports cross-Region and cross-account snapshot copy in a single operation for RDS, Aurora, DocumentDB, and Neptune.
  • Cross-Account Management and Backup
    • uses AWS Organizations to manage backups across all AWS accounts centrally.
    • supports delegated administrator for backup management without accessing management accounts.
    • can “fan in” backups to a single repository account or “fan out” for greater resilience.
  • Incremental Backups
    • stores periodic backups incrementally for supported resource types.
    • first backup is a full copy; subsequent backups capture only changes.
  • Full AWS Backup Management
    • provides independent encryption using the KMS key of the AWS Backup vault.
    • uses awsbackup ARNs for backup-specific access policies.
    • offers centralized backup billing and Cost Explorer cost allocation tags.
  • Backup Activity Monitoring
    • integrates with Amazon CloudWatch for metrics and alarms on backup/restore jobs.
    • integrates with AWS CloudTrail for audit logs of backup activity.
    • integrates with Amazon EventBridge for event-driven backup monitoring.
    • integrates with Amazon SNS for backup activity notifications.

AWS Backup Vault Lock

  • AWS Backup Vault Lock enables a write-once-read-many (WORM) model for backups.
  • prevents anyone (including root user) from deleting backups or altering their retention periods.
  • provides immutability to protect backups from inadvertent or malicious deletion.
  • has been assessed by Cohasset Associates for use in environments subject to SEC 17a-4, CFTC, and FINRA regulations.
  • supports both Governance mode (allows authorized users to modify) and Compliance mode (prevents all changes including by root user).
  • can be configured via the AWS Console, CLI, API, or SDK.

AWS Backup Logically Air-Gapped Vault

  • Logically air-gapped vaults store immutable backup copies that are locked by default in Compliance mode.
  • backups are isolated in a separate AWS Backup service-owned account for additional security.
  • supports encryption using AWS-owned keys (AOKs) or AWS KMS customer-managed keys (CMKs).
  • supports secure sharing of backup access across accounts and organizations using AWS Resource Access Manager (RAM).
  • supports direct restore from the vault to reduce recovery time.
  • supports primary backups directly to logically air-gapped vaults, eliminating the need for secondary copy operations.
  • supports Multi-party approval to authorize access to backups even when the owning account is compromised.
  • supports Amazon EBS, Amazon S3, Amazon EC2, Amazon RDS, Amazon Aurora, Amazon EFS, Amazon FSx (Lustre, Windows, OpenZFS), Amazon DynamoDB, and Amazon EKS.
  • provides robust protection against ransomware, insider threats, and account compromise.

AWS Backup Restore Testing

  • Restore testing enables automated, periodic evaluation of restore viability and recovery readiness.
  • allows scheduling automated restore operations in isolated environments to validate backups.
  • monitors restore job duration times to help meet Recovery Time Objectives (RTOs).
  • supports event-driven validation that runs when a restore testing job completes.
  • integrates with 3rd party malware scanning services to verify backup integrity.
  • helps demonstrate compliance with regulatory requirements for data recovery validation.

AWS Backup Audit Manager

  • AWS Backup Audit Manager helps simplify data governance and compliance management of backups.
  • provides built-in, customizable compliance controls aligned with organizational requirements.
  • automatically tracks backup activities and resources and detects violations.
  • generates daily reports on the compliance status of data protection frameworks.
  • reports include vault type, lock status, encryption details, archive settings, and retention periods.
  • findings can be imported into AWS Audit Manager for overall compliance posture.
  • supports legal hold to prevent backups from being deleted for preservation, auditing, or e-Discovery.

AWS Backup Search and Item-Level Recovery

  • allows searching the metadata of backups at a granular level for specific files or objects.
  • supports item-level search and recovery for Amazon EBS snapshots and Amazon S3 backups.
  • can be extended to Amazon EC2 instances for granular file-level recovery.
  • enables recovery of up to 5 items at a time without restoring the entire backup.
  • significantly reduces recovery time objectives (RTOs) for granular recovery scenarios.
  • supports creating backup indexes within backup policies for organization-wide search.

Amazon GuardDuty Malware Protection for AWS Backup

  • enables automated malware scanning of AWS Backup recovery points.
  • can be automated through backup plans or run as on-demand scans of existing backups.
  • detects malicious content before restoration to prevent reintroduction of compromised data.
  • uses multiple AWS and third-party malware scanning engines for comprehensive detection.
  • addresses a critical gap in ransomware recovery strategies.

AWS Backup Supported Services

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. For the production account, a SysOps administrator must ensure that all data is backed up daily for all current and future Amazon EC2 instances and Amazon Elastic File System (Amazon EFS) file systems. Backups must be retained for 30 days. Which solution will meet these requirements with the LEAST amount of effort?
    1. Create a backup plan in AWS Backup. Assign resources by resource ID, selecting all existing EC2 and EFS resources that are running in the account. Edit the backup plan daily to include any new resources. Schedule the backup plan to run every day with a lifecycle policy to expire backups after 30 days.
    2. Create a backup plan in AWS Backup. Assign resources by tags. Ensure that all existing EC2 and EFS resources are tagged correctly. Schedule the backup plan to run every day with a lifecycle policy to expire backups after 30 days.
    3. Create a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM). Assign all resources by resource ID, selecting all existing EC2 and EFS resources that are running in the account. Edit the lifecycle policy daily to include any new resources. Schedule the lifecycle policy to create snapshots every day with a retention period of 30 days.
    4. Create a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM). Assign all resources by tags. Ensure that all existing EC2 and EFS resources are tagged correctly. Schedule the lifecycle policy to create snapshots every day with a retention period of 30 days.
  2. A company needs to protect its AWS backups from ransomware attacks and ensure that even if an attacker compromises an administrator account, the backups cannot be deleted. Which AWS Backup feature should the company implement?
    1. Cross-Region backup copy
    2. AWS Backup Audit Manager
    3. AWS Backup Vault Lock in Compliance mode
    4. Tag-based backup policies
  3. A security team wants to ensure backup copies are stored in an isolated environment that is separate from the production account and protected from account compromise. The solution must also support direct restore capabilities. Which solution meets these requirements?
    1. Enable cross-Region backup with AWS Backup Vault Lock
    2. Copy backups to a separate AWS account using cross-account backup
    3. Store backups in AWS Backup logically air-gapped vaults
    4. Enable S3 Object Lock on the backup storage bucket
  4. A company wants to centrally manage backup policies across 50 AWS accounts and ensure compliance with data protection regulations. They need daily reports showing backup compliance status. Which combination of AWS services should be used? (Choose TWO)
    1. AWS Backup with AWS Organizations for cross-account backup management
    2. Amazon Data Lifecycle Manager with AWS Config
    3. AWS Backup Audit Manager for compliance reporting
    4. AWS Systems Manager with custom automation documents
    5. Amazon EventBridge with custom compliance rules
  5. A DevOps team needs to verify that their backup recovery process meets the organization’s Recovery Time Objective (RTO) of 4 hours. They want automated validation without manual intervention. Which AWS Backup feature should they use?
    1. AWS Backup Audit Manager compliance controls
    2. Amazon CloudWatch alarms on restore job duration
    3. AWS Backup restore testing with scheduled validation
    4. Cross-Region backup copy with monitoring
  6. A data engineer needs to quickly locate and restore a specific file from an Amazon EBS snapshot without restoring the entire volume. Which AWS Backup capability allows this?
    1. Point-in-time recovery
    2. AWS Backup search and item-level recovery
    3. Cross-Region restore
    4. Full volume restore with custom configuration
  7. A company wants to scan their AWS Backup recovery points for malware before restoring them to production to prevent reintroduction of compromised data. Which solution should they implement?
    1. AWS Config rules to check backup integrity
    2. AWS Backup restore testing with custom validation scripts
    3. Amazon GuardDuty Malware Protection for AWS Backup
    4. AWS Security Hub integrated with backup monitoring

References

AWS S3 Object Lock

~ Last updated on : ~ jayendrapatil ~ 1 Comment

AWS S3 Object Lock

  • S3 Object Lock helps to store objects using a write-once-read-many (WORM) model.
  • can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely.
  • can help meet regulatory requirements that require WORM storage or add an extra layer of protection against object changes and deletion.
  • can be enabled for both new and existing buckets.
    • Since Nov 2023, Object Lock can be enabled on existing buckets directly through the console, CLI, API, or SDKs without contacting AWS Support.
  • works only in versioned buckets (general purpose buckets only; not supported on directory buckets).
  • Once Object Lock is enabled
    • Object Lock can’t be disabled
    • automatically enables versioning for the bucket
    • versioning can’t be suspended for the bucket.
  • provides two ways to manage object retention.
    • Retention period
      • protects an object version for a fixed amount of time, during which an object remains locked.
      • During this period, the object is WORM-protected and can’t be overwritten or deleted.
      • can be applied on an object version either explicitly or through a bucket default setting.
      • S3 stores a timestamp in the object version’s metadata to indicate when the retention period expires. After the retention period expires, the object version can be overwritten or deleted unless you also placed a legal hold on the object version.
      • Retention period can be extended but never shortened (in both compliance and governance modes).
      • Minimum and maximum allowable retention periods can be enforced using the s3:object-lock-remaining-retention-days condition key in a bucket policy.
    • Legal hold
      • protects an object version, as a retention period, but it has no expiration date.
      • remains in place until you explicitly remove it.
      • can be freely placed and removed by any user who has the s3:PutObjectLegalHold permission.
      • are independent of retention periods.
      • ideal when the duration of protection is unknown (e.g., litigation, investigations, audits).
    • Retention periods and legal holds apply to individual object versions.
    • Placing a retention period or legal hold on an object protects only the version specified in the request. It doesn’t prevent new versions of the object from being created.
    • An object version can have both a retention period and a legal hold, one but not the other, or neither.
  • provides two retention modes that apply different levels of protection to the objects
    • Governance mode
    • Compliance mode
  • S3 buckets with S3 Object Lock can’t be used as destination buckets for server access logs.
  • has been assessed by Cohasset Associates for use in environments that are subject to SEC 17a-4, CFTC, and FINRA regulations.
  • Objects protected by Object Lock (both GOVERNANCE and COMPLIANCE modes) do not allow annotation modifications (create, update, or delete). To add annotations to a locked object, create a new object version.
  • provides critical defense against ransomware attacks by preventing backup and archive data from being deleted or altered.

S3 Object Lock – Retention Modes

Governance mode

  • Users can’t overwrite or delete an object version or alter its lock settings unless they have special permissions.
  • Objects can be protected from being deleted by most users, but some users can be granted permission to alter the retention settings or delete the object if necessary.
  • Can be used to test retention-period settings before creating a compliance-mode retention period.
  • To override or remove governance-mode retention settings, a user must have the s3:BypassGovernanceRetention permission and must explicitly include x-amz-bypass-governance-retention:true as a request header.
  • The S3 console automatically applies the bypass header if the user has the s3:BypassGovernanceRetention permission.
  • Bypassing governance mode doesn’t affect an object version’s legal hold status.

Compliance mode

  • A protected object version can’t be overwritten or deleted by any user, including the root user in the AWS account.
  • Object retention mode can’t be changed, and its retention period can’t be shortened (but can be extended).
  • Object versions can’t be overwritten or deleted for the duration of the retention period.
  • The only way to delete an object under compliance mode before its retention date expires is to delete the associated AWS account.
  • Compliance mode provides the strict immutability required by regulations such as SEC 17a-4(f).

S3 Object Lock – How Deletes Work

  • If a bucket has Object Lock enabled and the object is protected by a retention period or legal hold:
    • Permanent DELETE request (specifies a version ID) – S3 returns an Access Denied (403 Forbidden) error.
    • Simple DELETE request (no version ID) – S3 returns 200 OK and inserts a delete marker. The protected object version is NOT deleted.
  • Delete markers are NOT WORM-protected, regardless of any retention period or legal hold on the underlying object.

S3 Object Lock – Default Bucket Configuration

  • A default retention period can be set on a bucket that applies automatically to all new objects placed in the bucket.
  • Default retention settings specify a mode (Governance or Compliance) and a duration (in days or years).
  • When an object is uploaded to a bucket with a default retention setting, S3 calculates a Retain Until Date by adding the duration to the object’s creation timestamp.
  • If an object is uploaded with an explicit individual retention mode and period, the object’s individual settings override the bucket defaults.
  • Default retention settings apply only to new objects; they do NOT retroactively apply to existing objects already in the bucket.
  • S3 Batch Operations can be used to apply Object Lock retention or legal holds to existing objects at scale.

S3 Object Lock with Replication

  • Object Lock can be used with S3 Replication (CRR and SRR) to replicate locked objects and their retention metadata across buckets.
  • If the source bucket has Object Lock enabled, the destination buckets must also have Object Lock enabled.
  • Retention settings replicate automatically with the objects.
  • The replication IAM role requires additional permissions: s3:GetObjectRetention and s3:GetObjectLegalHold.
  • Replication for Object Lock-enabled buckets can now be configured directly through the console without contacting AWS Support (since Nov 2023).

S3 Object Lock – Additional Considerations

  • Lifecycle management: S3 Lifecycle rules continue to function on protected objects (including placing delete markers and transitioning storage classes), but a locked version cannot be permanently deleted by a Lifecycle expiration policy until retention expires.
  • Encryption: Object Lock works with encrypted objects. However, it does not protect against losing access to encryption keys or keys being deleted.
  • S3 Inventory: S3 Inventory can include Object Lock metadata (retain until date, retention mode, legal hold status) in inventory reports.
  • S3 Storage Lens: Provides metrics for Object Lock-enabled storage bytes and object count.
  • Upload integrity: The Content-MD5 or x-amz-sdk-checksum-algorithm header is required when uploading an object with a retention period configured.
  • Events and notifications: S3 Event Notifications and CloudTrail can track access and changes to Object Lock configurations.
  • Retention period limits: Can set minimum and maximum allowable retention periods using bucket policies with the s3:object-lock-remaining-retention-days condition key. Maximum retention period is 100 years.

S3 Object Lock – Required Permissions

  • s3:PutObjectRetention – required to set a retention period on an object
  • s3:GetObjectRetention – required to view an object’s retention settings
  • s3:PutObjectLegalHold – required to place or remove a legal hold
  • s3:GetObjectLegalHold – required to view an object’s legal hold status
  • s3:PutBucketObjectLockConfiguration – required to configure Object Lock on a bucket
  • s3:GetBucketObjectLockConfiguration – required to view a bucket’s Object Lock configuration
  • s3:BypassGovernanceRetention – required to bypass governance mode protections

S3 Object Lock with Batch Operations

  • S3 Batch Operations can apply Object Lock retention or legal holds at scale to millions of existing objects.
  • Supports both PutObjectRetention and PutObjectLegalHold operations.
  • Manifests can be generated using S3 Inventory reports with Amazon Athena or on-demand manifest generation.
  • Useful for retroactively protecting existing data that was stored before Object Lock was enabled.
  • Enables tiered retention policies by organizing objects into separate manifests with different retention periods.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A company needs to store its accounting records in Amazon S3. No one at the company; including administrative users and root users, should be able to delete the records for an entire 10-year period. The records must be stored with maximum resiliency. Which solution will meet these requirements?
    1. Use an access control policy to deny deletion of the records for a period of 10 years.
    2. Use an IAM policy to deny deletion of the records. After 10 years, change the IAM policy to allow deletion.
    3. Use S3 Object Lock in compliance mode for a period of 10 years.
    4. Use S3 Object Lock in governance mode for a period of 10 years.
  2. A company wants to protect S3 objects from accidental deletion by users who have full S3 permissions. Users should still be able to delete objects if business needs arise, but only with explicit authorization from a security team. Which approach meets these requirements?
    1. Enable S3 Object Lock in compliance mode with a 1-year retention period.
    2. Enable S3 Object Lock in governance mode and restrict the s3:BypassGovernanceRetention permission to the security team’s IAM role.
    3. Enable MFA Delete on the S3 bucket.
    4. Use an S3 bucket policy to deny all delete operations.
  3. An organization has an existing S3 bucket with millions of objects. They need to apply WORM protection to all existing objects to meet a new compliance requirement. What is the MOST efficient approach?
    1. Copy all objects to a new bucket with Object Lock enabled.
    2. Contact AWS Support to enable Object Lock on the existing bucket.
    3. Enable Object Lock on the existing bucket and use S3 Batch Operations with a manifest from S3 Inventory to apply retention settings to existing objects.
    4. Write a Lambda function to apply retention settings to each object individually.
  4. A company has S3 Object Lock in compliance mode applied to financial records with a 7-year retention period. A legal request requires immediate deletion of certain records. What can be done?
    1. Use s3:BypassGovernanceRetention permission to delete the objects.
    2. Change the retention mode from compliance to governance, then delete.
    3. Shorten the retention period to expire immediately.
    4. The objects cannot be deleted until the retention period expires. The only option is to delete the entire AWS account.
  5. A DevOps team wants to protect backup data from ransomware. They want immutability but need the flexibility to delete backups early if storage costs become a concern. Which S3 Object Lock configuration should they use?
    1. Compliance mode with a long retention period.
    2. Governance mode with an appropriate retention period, restricting s3:BypassGovernanceRetention to administrators.
    3. Legal hold on all backup objects.
    4. S3 Versioning without Object Lock.

References

S3 Encryption Explained – SSE-S3 vs SSE-KMS vs SSE-C Compared

~ Last updated on : ~ jayendrapatil ~ 2 Comments

AWS S3 Encryption

📌 Key Updates (2023-2026)

  • January 2023: All new S3 object uploads are automatically encrypted with SSE-S3 by default at no additional cost.
  • Terminology Change: AWS KMS replaced “Customer Master Key (CMK)” with “KMS key.” The concept is unchanged.
  • June 2023: Dual-Layer Server-Side Encryption (DSSE-KMS) introduced for compliance workloads.
  • November 2025: New bucket-level setting to standardize encryption types (block SSE-C per bucket).
  • January 2026: UpdateObjectEncryption API allows changing encryption type without data movement.
  • April 2026: SSE-C is now disabled by default on all new general purpose buckets.
  • Client-Side Encryption: AmazonS3EncryptionClient is deprecated; use the standalone Amazon S3 Encryption Client (v4) with key commitment.
  • AWS S3 Encryption supports both data at rest and data in transit encryption.
  • Starting January 5, 2023, all new object uploads to Amazon S3 are automatically encrypted with SSE-S3 at no additional cost and with no impact on performance.
  • Data in-transit
    • S3 allows protection of data in transit by enabling communication via SSL/TLS or using client-side encryption.
  • Data at Rest
    • Server-Side Encryption
      • S3 encrypts the object before saving it on disks in its data centers and decrypts it when the objects are downloaded.
      • SSE-S3 is automatically applied as the base level of encryption for every bucket.
    • Client-Side Encryption
      • Data is encrypted at the client-side and uploaded to S3.
      • The encryption process, the encryption keys, and related tools are managed by the user.

S3 Server-Side Encryption

  • Server-side encryption is about data encryption at rest.
  • Server-side encryption encrypts only the object data.
  • Any object metadata is not encrypted.
  • S3 handles the encryption (as it writes to disks) and decryption (when objects are accessed) of the data objects.
  • There is no difference in the access mechanism for both encrypted and unencrypted objects and is handled transparently by S3.
  • Starting January 5, 2023, SSE-S3 is applied as the base level of encryption for every bucket in Amazon S3. All new object uploads are automatically encrypted.
  • S3 supports the following server-side encryption options:
    • SSE-S3 – Server-Side Encryption with S3-Managed Keys (default)
    • SSE-KMS – Server-Side Encryption with AWS KMS Keys
    • DSSE-KMS – Dual-Layer Server-Side Encryption with AWS KMS Keys
    • SSE-C – Server-Side Encryption with Customer-Provided Keys

Server-Side Encryption with S3-Managed Keys – SSE-S3

  • Encryption keys are handled and managed by AWS.
  • SSE-S3 is the default encryption for all S3 buckets. Since January 5, 2023, all new objects are automatically encrypted with SSE-S3 unless a different encryption option is specified.
  • Each object is encrypted with a unique data key employing strong multi-factor encryption.
  • SSE-S3 encrypts the data key with a root key that is regularly rotated.
  • S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to encrypt the data.
  • Whether or not objects are encrypted with SSE-S3 can’t be enforced when they are uploaded using pre-signed URLs, because the only way server-side encryption can be specified is through the AWS Management Console or through an HTTP request header.
  • Request must set header x-amz-server-side-encryption to AES256
  • For enforcing server-side encryption for all of the objects that are stored in a bucket, use a bucket policy that denies permissions to upload an object unless the request includes x-amz-server-side-encryption header to request server-side encryption.
  • Since all objects are now encrypted by default, bucket policies to enforce encryption are no longer strictly required but can still be used to enforce a specific encryption type (e.g., SSE-KMS over SSE-S3).
SSE-S3 : Server Side Encryption using S3 Managed Keys
Source: Oreilly

Server-Side Encryption with AWS KMS Keys – SSE-KMS

Server-Side Encryption with AWS KMS Keys (SSE-KMS)

  • SSE-KMS is similar to SSE-S3, but it uses AWS Key Management Service (KMS) which provides additional benefits along with additional charges.
    • KMS is a service that combines secure, highly available hardware and software to provide a key management system scaled for the cloud.
    • KMS uses KMS keys (previously called customer master keys or CMKs) to encrypt the S3 objects.
    • The KMS key material is never made available in plaintext.
    • KMS enables you to centrally create encryption keys, and define the policies that control how keys can be used.
    • Allows audit of key usage to prove they are being used correctly, by inspecting logs in AWS CloudTrail.
    • Allows keys to be temporarily disabled and re-enabled.
    • Allows keys to be rotated regularly (automatic annual rotation or on-demand rotation).
    • Security controls in AWS KMS can help meet encryption-related compliance requirements.
  • SSE-KMS enables separate permissions for the use of an envelope key (that is, a key that protects the data’s encryption key) that provides added protection against unauthorized access to the objects in S3.
  • SSE-KMS provides the option to create and manage encryption keys yourself (customer managed keys), or use an AWS managed key that is unique to you, the service you’re using, and the region you’re working in.
  • Creating and managing customer managed keys gives more flexibility, including the ability to create, rotate, disable, and define access controls, and audit the encryption keys used to protect the data.
  • Data keys used to encrypt the data are also encrypted and stored alongside the data they protect and are unique to each object.
  • Process flow
    • An application or AWS service client requests an encryption key to encrypt data and passes a reference to a KMS key under the account.
    • Client requests are authenticated based on whether they have access to use the KMS key.
    • A new data encryption key is created, and a copy of it is encrypted under the KMS key.
    • Both the data key and encrypted data key are returned to the client.
    • Data key is used to encrypt customer data and then deleted as soon as is practical.
    • Encrypted data key is stored for later use and sent back to AWS KMS when the source data needs to be decrypted.
  • S3 only supports symmetric KMS keys and not asymmetric keys.
  • Must set header x-amz-server-side-encryption to aws:kms

S3 Bucket Keys

  • S3 Bucket Keys reduce the cost of SSE-KMS by decreasing the request traffic from Amazon S3 to AWS KMS by up to 99%.
  • When enabled, S3 generates a bucket-level key from KMS and uses it to create data keys for objects in the bucket, reducing the number of KMS API calls.
  • S3 Bucket Keys are recommended for all SSE-KMS workloads to optimize both performance and cost.
  • S3 Bucket Keys are always enabled when using SSE-KMS with S3 Express One Zone.
  • Bucket Keys can be enabled at the bucket level or specified per object in PUT requests.
SSE-KMS : Server Side Encryption using AWS KMS managed keys
Source: Oreilly

Dual-Layer Server-Side Encryption with AWS KMS Keys – DSSE-KMS

  • Launched June 2023 for compliance workloads requiring two layers of encryption.
  • DSSE-KMS applies two independent layers of encryption to objects when they are uploaded to Amazon S3.
  • Each layer uses a different implementation of the 256-bit AES-GCM algorithm.
  • Designed to meet CNSSP 15 and other compliance standards requiring multi-layer encryption.
  • Can be specified in PUT/COPY requests or configured as the bucket’s default encryption.
  • Can be enforced using IAM and bucket policies.
  • Must set header x-amz-server-side-encryption to aws:kms:dsse
  • Higher cost than SSE-KMS due to additional processing overhead and KMS API calls.
  • Use cases: Government workloads, financial services, and any regulated industry requiring dual-layer encryption at rest.

Server-Side Encryption with Customer-Provided Keys – SSE-C

AWS S3 Server Side Encryption using Customer Provided Keys SSE-C

⚠️ Important Change (April 2026)

SSE-C is now disabled by default on all new general purpose buckets and existing buckets in accounts with no SSE-C encrypted objects. To use SSE-C, you must explicitly enable it by setting BlockedEncryptionTypes to NONE in the bucket’s default encryption configuration via the PutBucketEncryption API.

  • Encryption keys can be managed and provided by the Customer and S3 manages the encryption, as it writes to disks, and decryption, when you access the objects.
  • When you upload an object, the encryption key is provided as a part of the request and S3 uses that encryption key to apply AES-256 encryption to the data and removes the encryption key from memory.
  • When you download an object, the same encryption key should be provided as a part of the request. S3 first verifies the encryption key and if it matches, the object is decrypted before returning back to you.
  • As each object and each object’s version can be encrypted with a different key, you are responsible for maintaining the mapping between the object and the encryption key used.
  • SSE-C requests must be done through HTTPS and S3 will reject any requests made over HTTP when using SSE-C.
  • For security considerations, AWS recommends considering any key sent erroneously using HTTP to be compromised and it should be discarded or rotated.
  • S3 does not store the encryption key provided. Instead, a randomly salted HMAC value of the encryption key is stored which can be used to validate future requests. The salted HMAC value cannot be used to decrypt the contents of the encrypted object or to derive the value of the encryption key. That means, if you lose the encryption key, you lose the object.
  • Starting April 2026: SSE-C is disabled by default for all new general purpose buckets. You must explicitly enable SSE-C on a bucket before using it. This change was introduced to prevent ransomware attacks that exploited SSE-C with attacker-controlled keys.
SSE-C : Server-Side Encryption with Customer-Provided Keys
Source: Oreilly

Client-Side Encryption

Client-side encryption refers to encrypting data before sending it to S3 and decrypting the data after downloading it.

⚠️ SDK Update Notice

The original AmazonS3EncryptionClient class is deprecated. AWS now provides a standalone Amazon S3 Encryption Client library (currently at v4) that supports key commitment (AES-GCM with Key Commitment) for enhanced security. The AWS SDK for Java v1 reached end-of-support on December 31, 2025. Migrate to the standalone S3 Encryption Client or AWS SDK v2/v4 equivalents.

AWS KMS-managed Key (Client-Side Encryption with KMS – CSE-KMS)

  • Customer can maintain the encryption KMS key with AWS KMS and can provide the KMS key ID to the client to encrypt the data.
  • Uploading Object
    • The S3 Encryption Client first sends a request to AWS KMS for the key to encrypt the object data.
    • AWS KMS returns a randomly generated data encryption key with 2 versions: a plaintext version for encrypting the data and a cipher blob to be uploaded with the object as object metadata.
    • The client obtains a unique data encryption key for each object it uploads.
    • The S3 Encryption Client uploads the encrypted data and the cipher blob with object metadata.
  • Download Object
    • The client first downloads the encrypted object along with the cipher blob version of the data encryption key stored as object metadata.
    • The client then sends the cipher blob to AWS KMS to get the plaintext version of the same, so that it can decrypt the object data.
Client Side Encryption - KMS Key CSE-KMS
Source: Oreilly

Client-Side Master Key (CSE-C)

  • Encryption master keys are completely maintained at the Client-side.
  • Uploading Object
    • The S3 Encryption Client locally generates a random one-time-use symmetric key (data encryption key or data key).
    • Client encrypts the data encryption key using the customer-provided master key.
    • Client uses this data encryption key to encrypt the data of a single S3 object (for each object, the client generates a separate data key).
    • Client then uploads the encrypted data to S3 and also saves the encrypted data key and its material description as object metadata (x-amz-meta-x-amz-key) in S3 by default.
  • Downloading Object
    • Client first downloads the encrypted object from S3 along with the object metadata.
    • Using the material description in the metadata, the client first determines which master key to use to decrypt the encrypted data key.
    • Using that master key, the client decrypts the data key and uses it to decrypt the object.
  • Client-side master keys and your unencrypted data are never sent to AWS.
  • If the master key is lost the data cannot be decrypted.

UpdateObjectEncryption API (January 2026)

  • Launched January 29, 2026 – allows changing the server-side encryption type of existing S3 objects without any data movement.
  • Atomically updates the encryption key of objects regardless of size or storage class.
  • Uses envelope encryption to re-encrypt the data key with the newly specified encryption type.
  • Supported transitions: SSE-S3 → SSE-KMS, and applying S3 Bucket Keys to existing objects.
  • Can be used with S3 Batch Operations to change encryption type at scale while preserving object properties and S3 Lifecycle eligibility.
  • Eliminates the need to copy objects to change their encryption (previously required COPY operations).

Enforcing S3 Encryption

  • S3 Encryption in Transit
    • S3 Bucket Policy can be used to enforce SSL/TLS communication with S3 using the effect deny with condition aws:SecureTransport set to false.
  • S3 Default Encryption
    • Helps set the default encryption behavior for an S3 bucket so that all new objects are encrypted when they are stored in the bucket.
    • Objects are encrypted using SSE with either S3-managed keys (SSE-S3) or AWS KMS keys (SSE-KMS).
    • Since January 2023, SSE-S3 is automatically applied as the base level of encryption for all buckets. You can override this to SSE-KMS or DSSE-KMS.
  • S3 Bucket Policy
    • Can be applied to deny permissions to upload an object unless the request includes x-amz-server-side-encryption header to request server-side encryption.
    • Since all objects are now encrypted by default (SSE-S3), bucket policies are primarily useful to enforce a specific encryption type (e.g., SSE-KMS).
    • Bucket policies are evaluated before the default encryption.
  • Bucket-Level Encryption Standardization (November 2025)
    • New BlockedEncryptionTypes setting via the PutBucketEncryption API.
    • Allows disabling specific encryption types (e.g., SSE-C) at the bucket level.
    • Helps standardize the server-side encryption types used with your buckets.
    • Configurable via AWS Management Console, API, CLI, and CloudFormation.

S3 Bucket Policy Enforce Encryption

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A company is storing data on Amazon Simple Storage Service (S3). The company’s security policy mandates that data is encrypted at rest. Which of the following methods can achieve this? Choose 3 answers
    1. Use Amazon S3 server-side encryption with AWS Key Management Service managed keys
    2. Use Amazon S3 server-side encryption with customer-provided keys
    3. Use Amazon S3 server-side encryption with EC2 key pair.
    4. Use Amazon S3 bucket policies to restrict access to the data at rest.
    5. Encrypt the data on the client-side before ingesting to Amazon S3 using their own master key
    6. Use SSL to encrypt the data while in transit to Amazon S3.
  2. A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption (SSE-C) which of the below mentioned statements is true?
    1. The user should use the same encryption key for all versions of the same object
    2. It is possible to have different encryption keys for different versions of the same object
    3. AWS S3 does not allow the user to upload his own keys for server side encryption
    4. The SSE-C does not work when versioning is enabled
  3. A storage admin wants to encrypt all the objects stored in S3 using server side encryption. The user does not want to use the AES 256 encryption key provided by S3. How can the user achieve this?
    1. The admin should upload his secret key to the AWS console and let S3 decrypt the objects
    2. The admin should use CLI or API to upload the encryption key to the S3 bucket. When making a call to the S3 API mention the encryption key URL in each request
    3. S3 does not support client supplied encryption keys for server side encryption
    4. The admin should send the keys and encryption algorithm with each API call
  4. A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at rest. If the user is supplying his own keys for encryption (SSE-C), what is recommended to the user for the purpose of security?
    1. User should not use his own security key as it is not secure
    2. Configure S3 to rotate the user’s encryption key at regular intervals
    3. Configure S3 to store the user’s keys securely with SSL
    4. Keep rotating the encryption key manually at the client side
  5. A system admin is planning to encrypt all objects being uploaded to S3 from an application. The system admin does not want to implement his own encryption algorithm; instead he is planning to use server side encryption by supplying his own key (SSE-C). Which parameter is not required while making a call for SSE-C?
    1. x-amz-server-side-encryption-customer-key-AES-256
    2. x-amz-server-side-encryption-customer-key
    3. x-amz-server-side-encryption-customer-algorithm
    4. x-amz-server-side-encryption-customer-key-MD5
  6. You are designing a personal document-archiving solution for your global enterprise with thousands of employee. Each employee has potentially gigabytes of data to be backed up in this archiving solution. The solution will be exposed to the employees as an application, where they can just drag and drop their files to the archiving system. Employees can retrieve their archives through a web interface. The corporate network has high bandwidth AWS DirectConnect connectivity to AWS. You have regulatory requirements that all data needs to be encrypted before being uploaded to the cloud. How do you implement this in a highly available and cost efficient way?
    1. Manage encryption keys on-premise in an encrypted relational database. Set up an on-premises server with sufficient storage to temporarily store files and then upload them to Amazon S3, providing a client-side master key. (Storing temporary increases cost and not a high availability option)
    2. Manage encryption keys in a Hardware Security Module(HSM) appliance on-premise server with sufficient storage to temporarily store, encrypt, and upload files directly into Amazon Glacier. (Not cost effective)
    3. Manage encryption keys in Amazon Key Management Service (KMS), upload to Amazon Simple Storage Service (S3) with client-side encryption using a KMS key ID and configure Amazon S3 lifecycle policies to store each object using the Amazon S3 Glacier storage class. (with CSE-KMS the encryption happens at client side before the object is uploaded to S3 and KMS is cost effective as well)
    4. Manage encryption keys in an AWS CloudHSM appliance. Encrypt files prior to uploading on the employee desktop and then upload directly into Amazon Glacier (Not cost effective)
  7. A user has enabled server side encryption with S3. The user downloads the encrypted object from S3. How can the user decrypt it?
    1. S3 does not support server side encryption
    2. S3 provides a server side key to decrypt the object
    3. The user needs to decrypt the object using their own private key
    4. S3 manages encryption and decryption automatically
  8. When uploading an object, what request header can be explicitly specified in a request to Amazon S3 to encrypt object data when saved on the server side?
    1. x-amz-storage-class
    2. Content-MD5
    3. x-amz-security-token
    4. x-amz-server-side-encryption
  9. A company must ensure that any objects uploaded to an S3 bucket are encrypted. Which of the following actions should the SysOps Administrator take to meet this requirement? (Select TWO.)
    1. Implement AWS Shield to protect against unencrypted objects stored in S3 buckets.
    2. Implement Object access control list (ACL) to deny unencrypted objects from being uploaded to the S3 bucket.
    3. Implement Amazon S3 default encryption to make sure that any object being uploaded is encrypted before it is stored.
    4. Implement Amazon Inspector to inspect objects uploaded to the S3 bucket to make sure that they are encrypted.
    5. Implement S3 bucket policies to deny unencrypted objects from being uploaded to the buckets.
  10. A company wants to ensure all objects in their S3 bucket are encrypted with SSE-KMS using a specific customer managed key. They also want to reduce AWS KMS costs. What combination of steps should be taken? (Select TWO.)
    1. Configure the bucket’s default encryption to use SSE-KMS with the specific customer managed KMS key.
    2. Configure a bucket policy to deny all s3:PutObject requests that don’t include the x-amz-server-side-encryption header set to AES256.
    3. Enable S3 Transfer Acceleration to reduce KMS API calls.
    4. Enable S3 Bucket Keys to reduce request traffic from S3 to KMS and lower costs by up to 99%.
    5. Use DSSE-KMS to apply dual-layer encryption for cost savings.
  11. An organization needs to change the encryption type of millions of existing S3 objects from SSE-S3 to SSE-KMS without impacting object metadata or lifecycle policies. What is the most efficient approach?
    1. Download all objects and re-upload them with SSE-KMS specified in the PUT request.
    2. Use S3 Batch Operations with a COPY operation to copy objects in-place with SSE-KMS encryption.
    3. Use S3 Batch Operations with the UpdateObjectEncryption operation to atomically change the encryption type without data movement.
    4. Change the bucket default encryption to SSE-KMS; existing objects will be automatically re-encrypted.

References

S3 Versioning – How It Works, MFA Delete & Best Practices

~ Last updated on : ~ jayendrapatil ~ 7 Comments

S3 Versioning

  • S3 Versioning helps to keep multiple variants of an object in the same bucket and can be used to preserve, retrieve, and restore every version of every object stored in the S3 bucket.
  • S3 Object Versioning can be used to protect from unintended overwrites and accidental deletions
  • As Versioning maintains multiple copies of the same objects as a whole and charges accrue for multiple versions for e.g. for a 1GB file with 5 copies with minor differences would consume 5GB of S3 storage space and you would be charged for the same.
  • Buckets can be in one of the three states
    • Unversioned (the default)
    • Versioning-enabled
    • Versioning-suspended
  • S3 Object Versioning is not enabled by default and has to be explicitly enabled for each bucket.
  • Versioning once enabled, cannot be disabled and can only be suspended
  • Versioning enabled on a bucket applies to all the objects within the bucket
  • Permissions are set at the version level. Each version has its own object owner; an AWS account that creates the object version is the owner. So, you can set different permissions for different versions of the same object.
  • Irrespective of the Versioning, each object in the bucket has a version.
    • For Non Versioned bucket, the version ID for each object is null
    • For Versioned buckets, a unique version ID is assigned to each object
  • With Versioning, version ID forms a key element to define the uniqueness of an object within a bucket along with the bucket name and object key
  • After enabling versioning on a bucket for the first time, it may take up to 15 minutes for the change to fully propagate. During this time, GET requests for objects created or updated after enabling versioning may result in HTTP 404 NoSuchKey errors. AWS recommends waiting 15 minutes after enabling versioning before issuing write operations (PUT or DELETE) on objects in the bucket.
  • Objects that are stored in the bucket before versioning is enabled have a version ID of null. When versioning is enabled, existing objects do not change; only how S3 handles future requests changes.

Object Retrieval

  • For Non Versioned bucket
    • An Object retrieval always returns the only object available.
  • For Versioned bucket
    • An object retrieval returns the Current latest object.
    • Non-Current objects can be retrieved by specifying the version ID.

Object Addition

  • For Non Versioned bucket
    • If an object with the same key is uploaded again it overwrites the object
  • For Versioned bucket
    • If an object with the same key is uploaded, the newly uploaded object becomes the current version and the previous object becomes the non-current version.
    • A non-current versioned object can be retrieved and restored hence protecting against accidental overwrites
    • If S3 receives multiple write requests for the same object simultaneously, it stores all of those objects as separate versions.

Object Deletion

  • For Non Versioned bucket
    • An object is permanently deleted and cannot be recovered
  • For the Versioned bucket,
    • All versions remain in the bucket and Amazon inserts a delete marker which becomes the Current version
    • A non-current versioned object can be retrieved and restored hence protecting against accidental deletions
    • If an Object with a specific version ID is deleted, a permanent deletion happens and the object cannot be recovered

Delete marker

  • Delete Marker object does not have any data or ACL associated with it, just the key and the version ID
  • An object retrieval on a bucket with a delete marker as the Current version would return a 404
  • Only a DELETE operation is allowed on the Delete Marker object
  • If the Delete marker object is deleted by specifying its version ID, the previous non-current version object becomes the current version object
  • If a DELETE request is fired on an object with Delete Marker as the current version, the Delete marker object is not deleted but a Delete Marker is added again

S3 Versioning - Delete Operation

Restoring Previous Versions

  • Copy a previous version of the object into the same bucket. The copied object becomes the current version of that object and all object versions are preserved – Recommended as it keeps all the versions.
  • Permanently delete the current version of the object. When you delete the current object version, you, in effect, turn the previous version into the current version of that object.

Versioning Suspended Bucket

  • Versioning can be suspended to stop accruing new versions of the same object in a bucket.
  • Existing objects in the bucket do not change and only future requests behavior changes.
  • An object with version ID null is added for each new object addition.
  • For each object addition with the same key name, the object with the version ID null is overwritten.
  • An object retrieval request will always return the current version of the object.
  • A DELETE request on the bucket would permanently delete the version ID null object and inserts a Delete Marker
  • A DELETE request does not delete anything if the bucket does not have an object with version ID null
  • A DELETE request can still be fired with a specific version ID for any previous object with version IDs stored

S3 Versioning with S3 Lifecycle

  • S3 Lifecycle can be used to manage versioned objects and control storage costs by automatically transitioning or expiring noncurrent versions.
  • NoncurrentVersionExpiration action permanently deletes noncurrent object versions after a specified number of days.
  • NoncurrentVersionTransition action transitions noncurrent versions to a cheaper storage class (e.g., S3 Standard-IA, S3 Glacier) after a specified number of days.
  • NewerNoncurrentVersions parameter allows retaining a specific number of noncurrent versions (up to 100) before lifecycle actions apply. This helps retain only the most recent N versions for recovery while expiring older ones.
  • If you have an object expiration lifecycle configuration in your unversioned bucket and you want to maintain the same permanent delete behavior when you enable versioning, you must add a noncurrent expiration configuration.
  • Lifecycle rules help control versioning storage costs by automatically cleaning up old versions that are no longer needed.
  • MFA Delete cannot be used with lifecycle configurations.

S3 Object Lock

  • S3 Object Lock provides write-once-read-many (WORM) protection for S3 objects.
  • S3 Object Lock requires versioning to be enabled on the bucket. When Object Lock is enabled, versioning is automatically enabled and cannot be suspended.
  • Object Lock prevents locked object versions from being permanently deleted or overwritten.
  • Object Lock provides two retention modes:
    • Governance Mode – Users with specific IAM permissions (s3:BypassGovernanceRetention) can override or remove the retention settings. Provides protection against most users but allows authorized overrides.
    • Compliance Mode – No user, including the root account, can overwrite or delete a protected object version during the retention period. The retention mode cannot be changed, and the retention period cannot be shortened.
  • Legal Hold provides the same protection as a retention period but has no expiration date. It remains in place until explicitly removed by a user with the s3:PutObjectLegalHold permission.
  • Object Lock can only be enabled at bucket creation time (cannot be added to existing buckets without contacting AWS Support).
  • S3 Object Lock works at the individual object version level.

S3 Versioning with S3 Replication

  • S3 Replication (both Cross-Region Replication and Same-Region Replication) requires versioning to be enabled on both the source and destination buckets.
  • Live replication automatically replicates new and updated objects as they are written to the source bucket.
  • S3 Batch Replication can replicate existing objects that were added before replication was configured.
  • Replication replicates version-specific metadata including version ID, storage class, and retention information.
  • Delete markers can optionally be replicated to the destination bucket.

MFA Delete

  • Additional security can be enabled by configuring a bucket to enable MFA (Multi-Factor Authentication) for the deletion of objects.
  • MFA Delete enabled, requires additional authentication for operations
    • Changing the versioning state of the bucket
    • Permanently deleting an object version
  • MFA Delete requires two forms of authentication: security credentials + the six-digit code from an approved MFA device.
  • MFA Delete can be enabled on a bucket to ensure that data in the bucket cannot be accidentally deleted
  • While the bucket owner, the AWS account that created the bucket (root account), and all authorized IAM users can enable versioning, but only the bucket owner (root account) can enable MFA Delete.
  • MFA Delete however does not prevent deletion or allow restoration.
  • MFA Delete cannot be enabled using the AWS Management Console. You must use the AWS Command Line Interface (AWS CLI) or the API.
  • MFA Delete cannot be used with lifecycle configurations.
  • To identify buckets that have MFA Delete enabled, you can use Amazon S3 Storage Lens metrics.
  • Both hardware and virtual MFA devices can be used with MFA Delete.

Versioning Cost Optimization Best Practices

  • Each version of an object is the entire object (not a diff/delta), so storage costs increase linearly with version count.
  • Use S3 Lifecycle rules with NoncurrentVersionExpiration to automatically delete old versions after a defined retention period.
  • Use NewerNoncurrentVersions to retain only the most recent N noncurrent versions (e.g., keep 3 latest versions).
  • Transition noncurrent versions to cheaper storage classes (S3 Standard-IA, S3 Glacier) using NoncurrentVersionTransition before expiring them.
  • Unoptimized versioning can generate 15-25% of total storage costs in production environments.
  • Monitor versioning storage using S3 Storage Lens and S3 Metadata to identify buckets with excessive noncurrent versions.
  • Consider suspending versioning (not disabling) if the use case no longer requires version history, but note existing versions remain and continue to incur charges.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Which set of Amazon S3 features helps to prevent and recover from accidental data loss?
    1. Object lifecycle and service access logging
    2. Object versioning and Multi-factor authentication
    3. Access controls and server-side encryption
    4. Website hosting and Amazon S3 policies
  2. You use S3 to store critical data for your company Several users within your group currently have full permissions to your S3 buckets. You need to come up with a solution that does not impact your users and also protect against the accidental deletion of objects. Which two options will address this issue? Choose 2 answers
    1. Enable versioning on your S3 Buckets
    2. Configure your S3 Buckets with MFA delete
    3. Create a Bucket policy and only allow read only permissions to all users at the bucket level
    4. Enable object life cycle policies and configure the data older than 3 months to be archived in Glacier
  3. To protect S3 data from both accidental deletion and accidental overwriting, you should
    1. enable S3 versioning on the bucket
    2. access S3 data using only signed URLs
    3. disable S3 delete using an IAM bucket policy
    4. enable S3 Reduced Redundancy Storage
    5. enable Multi-Factor Authentication (MFA) protected access
  4. A user has not enabled versioning on an S3 bucket. What will be the version ID of the object inside that bucket?
    1. 0
    2. There will be no version attached
    3. Null
    4. Blank
  5. A user is trying to find the state of an S3 bucket with respect to versioning. Which of the below mentioned states AWS will not return when queried?
    1. versioning-enabled
    2. versioning-suspended
    3. unversioned
    4. versioned
  6. A company wants to ensure that objects stored in S3 cannot be deleted or overwritten by any user, including the root account, for a period of 7 years to meet regulatory compliance. Which S3 features should be used? [Select 2]
    1. S3 Versioning
    2. S3 Object Lock in Compliance mode
    3. S3 Object Lock in Governance mode
    4. S3 MFA Delete
    5. S3 Lifecycle policies
  7. A company has enabled versioning on an S3 bucket but is concerned about increasing storage costs. Which feature allows them to automatically retain only the 3 most recent noncurrent versions and expire older ones?
    1. NoncurrentVersionExpiration with NoncurrentDays
    2. NoncurrentVersionExpiration with NewerNoncurrentVersions
    3. S3 Intelligent-Tiering
    4. S3 Object Lock retention period
  8. Which of the following S3 features requires versioning to be enabled on the bucket? [Select 2]
    1. S3 Cross-Region Replication
    2. S3 Object Lock
    3. S3 Transfer Acceleration
    4. S3 Event Notifications
    5. S3 Static Website Hosting
  9. After enabling versioning on an S3 bucket for the first time, a developer immediately uploads an object but receives an HTTP 404 NoSuchKey error when trying to retrieve it. What is the most likely cause?
    1. The bucket policy does not allow GetObject
    2. The object was uploaded to the wrong bucket
    3. Versioning changes may take up to 15 minutes to propagate after first enablement
    4. The object is encrypted and the developer lacks KMS permissions
  10. A company wants to use S3 Object Lock to protect sensitive data. Which statement is correct about the relationship between Object Lock and Versioning?
    1. Object Lock can be enabled without versioning
    2. Object Lock automatically disables versioning
    3. Object Lock automatically enables versioning, and versioning cannot be suspended while Object Lock is active
    4. Object Lock requires versioning to be suspended

References

AWS Storage Gateway

~ Last updated on : ~ jayendrapatil ~ 35 Comments

AWS Storage Gateway

  • AWS Storage Gateway connects on-premises software appliances with cloud-based storage to provide seamless integration with data security features between on-premises and the AWS storage infrastructure.
  • AWS Storage Gateway is a hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage.
  • Storage Gateway allows storage of data in the AWS cloud for scalable and cost-effective storage while maintaining data security.
  • Storage Gateway can run either on-premises, as a VM appliance (on VMware ESXi, Microsoft Hyper-V, or Linux KVM), or in AWS, as an EC2 instance. So if the on-premises data center goes offline and there is no available host, the gateway can be deployed on an EC2 instance.
  • Gateways hosted on EC2 instances can be used for disaster recovery, data mirroring, and providing storage for applications hosted on EC2.
  • Storage Gateway, by default, uploads data using SSL and provides data encryption at rest when stored in S3 or Glacier using AES-256.
  • Storage Gateway performs encryption of data-in-transit and at-rest.
  • Storage Gateway supports four key hybrid cloud use cases:
    • Move backups and archives to the cloud
    • Reduce on-premises storage with cloud-backed file shares
    • Provide on-premises applications low-latency access to data stored in AWS
    • Data lake access for pre and post processing workflows
  • Storage Gateway offers multiple types:
    • Amazon S3 File Gateway
    • Amazon FSx File Gateway (no longer available to new customers as of October 28, 2024)
    • Volume Gateway
    • Tape Gateway
  • Storage Gateway integrates with AWS Backup for centralized backup management of Volume Gateway volumes.
  • Storage Gateway supports public, Amazon VPC, and FIPS service endpoints.
  • Storage Gateway supports IPv6 via dual-stack endpoints (announced September 2025).
  • Storage Gateway supports VPC endpoint policies for granular access control (announced September 2025).

⚠️ Important Notices

  • Hardware Appliance End of Availability: As of May 12, 2025, the AWS Storage Gateway Hardware Appliance is no longer available for new purchases. Existing customers can continue to use and receive support until May 2028.
  • Amazon FSx File Gateway: No longer available to new customers as of October 28, 2024. Existing customers can continue to use the service. AWS recommends using Amazon FSx for Windows File Server directly with multi-AZ support.
  • AL2 to AL2023 Migration: All AL2-based Storage Gateway appliances must be migrated to Amazon Linux 2023 (AL2023) before June 30, 2026, after which they will no longer receive software updates, security patches, or bug fixes.

Storage Gateway Deployment Options

  • Storage Gateway can be deployed in several ways:
    • Virtual Machine (VM) – on VMware ESXi, Microsoft Hyper-V, or Linux KVM on-premises
    • Hardware Appliance – dedicated on-premises hardware (end of availability May 12, 2025)
    • VM in VMware Cloud on AWS – for VMware-based cloud environments
    • Amazon EC2 instance – deployed within Amazon VPC
  • Storage Gateway provides high availability on VMware through VMware vSphere High Availability (VMware HA), automatically recovering from most service interruptions in under 60 seconds.
  • Storage Gateway supports local cache of up to 64 TB for all gateway types.

Amazon S3 File Gateway

S3 File Gateway Architecture

  • Amazon S3 File Gateway supports a file interface into S3 and combines the service with a virtual software appliance.
  • Allows storing and retrieving of objects in S3 using industry-standard file protocols such as NFS and SMB.
  • Software appliance, or gateway, is deployed into the on-premises environment as a VM running on VMware ESXi, Microsoft Hyper-V, or Linux KVM hypervisor.
  • Provides access to objects in S3 as files or file share mount points. It can be considered as a file system mount on S3.
  • Durably stores POSIX-style metadata, including ownership, permissions, and timestamps in S3 as object user metadata associated with the file.
  • Provides a cost-effective alternative to on-premises storage.
  • Provides low-latency access to data through transparent local caching (up to 64 TiB).
  • Manages data transfer to and from AWS, buffers applications from network congestion, optimizes and streams data in parallel, and manages bandwidth consumption.
  • Easily integrates with services like IAM, KMS, CloudWatch, CloudTrail, etc.
  • S3 File Gateway publishes audit logs for SMB file share user operations to Amazon CloudWatch.
  • S3 File Gateway supports the following Amazon S3 storage classes:
    • S3 Standard
    • S3 Standard-Infrequent Access (S3 Standard-IA)
    • S3 One Zone-Infrequent Access (S3 One Zone-IA)
    • S3 Intelligent-Tiering
    • S3 Glacier Flexible Retrieval (via lifecycle policies)
    • S3 Glacier Deep Archive (via lifecycle policies)
  • S3 File Gateway does NOT support S3 Glacier Instant Retrieval storage class directly.
  • S3 File Gateway allows you to:
    • Store and retrieve files directly using the NFS version 3 or 4.1 protocol.
    • Store and retrieve files directly using the SMB file system version 2 and 3 protocol.
    • Access the data directly in S3 from any AWS Cloud application or service.
    • Manage S3 data using lifecycle policies, cross-region replication, and versioning.
  • Use cases include backing up on-premises file data to S3, hybrid cloud workflows, machine learning, and big data analytics.

Volume Gateways

  • Volume gateways provide cloud-backed storage volumes that can be mounted as Internet Small Computer System Interface (iSCSI) devices from the on-premises application servers.
  • All data is securely stored in AWS; the approach differs in how much data is stored on-premises.
  • Exposes a compatible iSCSI interface on the front end to easily integrate with existing backup applications and represents another disk drive.
  • Backs up the data incrementally by taking snapshots which are stored as EBS snapshots in S3. These snapshots can be restored as gateway storage volumes or used to create EBS volumes to be attached to an EC2 instance.
  • Volume Gateway integrates with AWS Backup for centralized backup management, supporting both cached and stored volumes.
  • Data written to volumes can be backed up using either the Storage Gateway native snapshot scheduler or AWS Backup service.

Gateway Cached Volumes

Storage Gateway Cached Volume
  • Gateway Cached Volumes store data in S3, which acts as primary data storage, and retains a copy of recently read data locally for low latency access to the frequently accessed data.
  • Gateway-cached volumes offer substantial cost savings on primary storage and minimize the need to scale the storage on-premises.
  • All gateway-cached volume data and snapshot data are stored in S3 encrypted at rest using server-side encryption (SSE) and it cannot be accessed with S3 API or any other tools.
  • Each gateway configured for gateway-cached volumes can support up to 32 volumes, with each volume ranging from 1 GiB to 32 TiB, for a total maximum storage volume of 1,024 TiB (1 PiB).
  • If you create a snapshot from a cached volume that is more than 16 TiB in size, you can restore it to a Storage Gateway volume but not to an Amazon EBS volume.
  • Gateway VM can be allocated disks:
    • Cache storage
      • Cache storage acts as the on-premises durable storage, stores the data before uploading it to S3.
      • Cache storage also stores recently read data for low-latency access.
      • Maximum cache size: 64 TiB.
    • Upload buffer
      • Upload buffer acts as a staging area before the data is uploaded to S3.
      • Gateway uploads data over an encrypted SSL connection to AWS, where it is stored encrypted in S3.

Gateway Stored Volumes

Storage Gateway Stored Volume
  • Gateway stored volumes maintain the entire data set locally to provide low-latency access.
  • Gateway asynchronously backs up point-in-time snapshots (in the form of EBS snapshots) of the data to S3 which provides durable off-site backups.
  • Gateway stored volume configuration provides durable and inexpensive off-site backups that you can recover to your local data center or EC2 for e.g., if you need replacement capacity for disaster recovery, you can recover the backups to EC2.
  • Each gateway configured for gateway-stored volumes can support up to 32 volumes, ranging from 1 GiB to 16 TiB, and total volume storage of 512 TiB.
  • Gateway VM can be allocated disks:
    • Volume Storage
      • For storing the actual data.
      • Can be mapped to on-premises direct-attached storage (DAS) or storage area network (SAN) disks.
    • Upload buffer
      • Upload buffer acts as a staging area before the data is uploaded to S3.
      • Gateway uploads data over an encrypted SSL connection to AWS, where it is stored encrypted in Amazon S3.

Tape Gateway – Gateway-Virtual Tape Library (VTL)

Storage Gateway VTL
  • Tape Gateway offers a durable, cost-effective data archival solution.
  • VTL interface can help leverage existing tape-based backup application infrastructure to store data on virtual tape cartridges created on the tape gateway.
  • Each Tape Gateway is preconfigured with a media changer and tape drives, which are available to the existing client backup applications as iSCSI devices. Tape cartridges can be added as needed to archive the data.
  • Tape Gateway provides a virtual tape infrastructure that scales seamlessly with business needs and eliminates the operational burden of provisioning, scaling, and maintaining a physical tape infrastructure.
  • Tape Gateway compresses data and transitions virtual tapes between Amazon S3 and Amazon S3 Glacier Flexible Retrieval (formerly S3 Glacier) or Amazon S3 Glacier Deep Archive to minimize storage costs.
  • Tape Gateway on AWS Snowball Edge enables offline migration of petabytes of physical tape data to AWS without network bandwidth constraints.
  • Tape Gateway has the following components:
    • Virtual Tape
      • Virtual tape is similar to the physical tape cartridge, except that the data is stored in the AWS storage solution.
      • Each gateway can contain 1500 tapes or up to 1 PiB of total tape data, with each tape ranging from 100 GiB to 15 TiB (increased from 5 TiB in 2022).
    • Virtual Tape Library (VTL)
      • Virtual tape library is similar to the physical tape library with tape drives (replaced with VTL tape drive) and robotic arms (replaced with Media changer).
      • Tapes in the Virtual tape library are backed up in Amazon S3.
      • Backup software writes data to the gateway, the gateway stores data locally, and then asynchronously uploads it to virtual tapes in S3.
    • Archive (Virtual Tape Shelf – VTS)
      • Virtual tape shelf is similar to the offsite tape holding facility.
      • Archived tapes are stored in Amazon S3 Glacier Flexible Retrieval (formerly S3 Glacier) or Amazon S3 Glacier Deep Archive for extremely low-cost storage for data archiving.
      • VTS is located in the same region where the gateway was created and every region would have a single VTS irrespective of the number of gateways.
      • Archiving tapes:
        • When the backup software ejects a tape, the gateway moves the tape to the VTS (S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive based on the tape pool).
      • Retrieving tapes:
        • Tapes archived in S3 Glacier Flexible Retrieval are typically available within 3-5 hours.
        • Tapes archived in S3 Glacier Deep Archive are typically available within 12 hours.
      • Tapes can be moved from S3 Glacier Flexible Retrieval to S3 Glacier Deep Archive to further reduce costs, but cannot be moved back.
  • Gateway VM can be allocated disks for:
    • Cache storage
      • Cache storage acts as the on-premises durable storage, stores the data before uploading it to S3.
      • Cache storage also stores recently read data for low-latency access.
      • Maximum cache size: 64 TiB.
    • Upload buffer
      • Upload buffer acts as a staging area before the data is uploaded to the Virtual tape.
      • Gateway uploads data over an encrypted SSL connection to AWS, where it is stored encrypted in S3.
      • Maximum upload buffer: 2 TiB.

Tape Gateway on AWS Snowball Edge

  • Tape Gateway on Snowball Edge enables offline migration of petabytes of physical tape data to AWS without changing existing tape-based backup workflows.
  • A standard Tape Gateway uses the network connection to transfer data asynchronously; Tape Gateway on Snowball Edge stores data on the device itself until returned to AWS.
  • After receiving the device, unlock it, set up a Tape Gateway on it, copy tape data to it, and ship it back to AWS.
  • AWS stores tape data in S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive.
  • Each Snowball Edge device can migrate up to 80 TB of tape data.
  • Ideal for environments with network-connectivity limitations, bandwidth constraints, or high connection costs.

Amazon FSx File Gateway (No Longer Available to New Customers)

⚠️ Notice: Amazon FSx File Gateway is no longer available to new customers as of October 28, 2024. Existing customers can continue to use the service normally. AWS recommends using Amazon FSx for Windows File Server directly with multi-AZ support for similar capabilities.

  • Amazon FSx File Gateway provided low-latency, on-premises access to fully managed file shares in Amazon FSx for Windows File Server.
  • Used SMB protocol for user or team file shares and file-based application migrations.
  • Maintained a local cache for low-latency access to frequently accessed data.
  • For new deployments, use Amazon FSx for Windows File Server directly.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Which of the following services natively encrypts data at rest within an AWS region? Choose 2 answers
    1. AWS Storage Gateway
    2. Amazon DynamoDB
    3. Amazon CloudFront
    4. Amazon Glacier
    5. Amazon Simple Queue Service
  2. What does the AWS Storage Gateway provide?
    1. It allows to integrate on-premises IT environments with Cloud Storage
    2. A direct encrypted connection to Amazon S3.
    3. It’s a backup solution that provides an on-premises Cloud storage.
    4. It provides an encrypted SSL endpoint for backups in the Cloud.
  3. You’re running an application on-premises due to its dependency on non-x86 hardware and want to use AWS for data backup. Your backup application is only able to write to POSIX-compatible block-based storage. You have 140TB of data and would like to mount it as a single folder on your file server. Users must be able to access portions of this data while the backups are taking place. What backup solution would be most appropriate for this use case?
    1. Use Storage Gateway and configure it to use Gateway Cached volumes.
    2. Configure your backup software to use S3 as the target for your data backups.
    3. Configure your backup software to use Glacier as the target for your data backups
    4. Use Storage Gateway and configure it to use Gateway Stored volumes (Data is hosted on the On-premise server as well. The requirement for 140TB is for file server On-Premise more to confuse and not in AWS. Just need a backup solution hence stored instead of cached volumes)
  4. A customer has a single 3-TB volume on-premises that is used to hold a large repository of images and print layout files. This repository is growing at 500 GB a year and must be presented as a single logical volume. The customer is becoming increasingly constrained with their local storage capacity and wants an off-site backup of this data, while maintaining low-latency access to their frequently accessed data. Which AWS Storage Gateway configuration meets the customer requirements?
    1. Gateway-Cached volumes with snapshots scheduled to Amazon S3
    2. Gateway-Stored volumes with snapshots scheduled to Amazon S3
    3. Gateway-Virtual Tape Library with snapshots to Amazon S3
    4. Gateway-Virtual Tape Library with snapshots to Amazon Glacier
  5. You have a proprietary data store on-premises that must be backed up daily by dumping the data store contents to a single compressed 50GB file and sending the file to AWS. Your SLAs state that any dump file backed up within the past 7 days can be retrieved within 2 hours. Your compliance department has stated that all data must be held indefinitely. The time required to restore the data store from a backup is approximately 1 hour. Your on-premise network connection is capable of sustaining 1gbps to AWS. Which backup methods to AWS would be most cost-effective while still meeting all of your requirements?
    1. Send the daily backup files to Glacier immediately after being generated (will not meet the RTO)
    2. Transfer the daily backup files to an EBS volume in AWS and take daily snapshots of the volume (Not cost effective)
    3. Transfer the daily backup files to S3 and use appropriate bucket lifecycle policies to send to Glacier (Store in S3 for seven days and then archive to Glacier)
    4. Host the backup files on a Storage Gateway with Gateway-Cached Volumes and take daily snapshots (Not Cost effective as local storage as well as S3 storage)
  6. A customer implemented AWS Storage Gateway with a gateway-cached volume at their main office. An event takes the link between the main and branch office offline. Which methods will enable the branch office to access their data? Choose 3 answers
    1. Use a HTTPS GET to the Amazon S3 bucket where the files are located (gateway volumes are only accessible from the AWS Storage Gateway and cannot be directly accessed using Amazon S3 APIs)
    2. Restore by implementing a lifecycle policy on the Amazon S3 bucket.
    3. Make an Amazon Glacier Restore API call to load the files into another Amazon S3 bucket within four to six hours.
    4. Launch a new AWS Storage Gateway instance AMI in Amazon EC2, and restore from a gateway snapshot
    5. Create an Amazon EBS volume from a gateway snapshot, and mount it to an Amazon EC2 instance.
    6. Launch an AWS Storage Gateway virtual iSCSI device at the branch office, and restore from a gateway snapshot
  7. A company uses on-premises servers to host its applications. The company is running out of storage capacity. The applications use both block storage and NFS storage. The company needs a high-performing solution that supports local caching without rearchitecting its existing applications. Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
    1. Mount Amazon S3 as a file system to the on-premises servers.
    2. Deploy an AWS Storage Gateway file gateway to replace NFS storage.
    3. Deploy AWS Snowball Edge to provision NFS mounts to on-premises servers.
    4. Deploy an AWS Storage Gateway volume gateway to replace the block storage.
    5. Deploy Amazon Elastic File System (Amazon EFS) volumes and mount them to on-premises servers.
  8. A company has petabytes of data stored on physical tapes in an offsite tape library. The company wants to migrate this tape data to AWS but has limited network bandwidth. Which solution meets these requirements with MINIMAL network usage?
    1. Set up a Tape Gateway and transfer tapes over the internet connection.
    2. Use AWS Snowball Edge with Tape Gateway to migrate tape data offline.
    3. Use AWS Direct Connect to transfer tape data to S3 Glacier.
    4. Set up an S3 File Gateway and copy tape contents as files.
  9. A company wants to archive virtual tapes at the lowest possible cost for long-term retention. The data is accessed less than once a year and can tolerate a 12-hour retrieval time. Which Tape Gateway archive storage class should they use?
    1. Amazon S3 Standard
    2. Amazon S3 Glacier Instant Retrieval
    3. Amazon S3 Glacier Flexible Retrieval
    4. Amazon S3 Glacier Deep Archive (Lowest cost, 12-hour retrieval time acceptable for once-a-year access)
  10. A solutions architect needs to provide on-premises applications with low-latency access to data stored in AWS while ensuring all data is backed up using a centralized backup service. Which combination of services should be used? (Choose two.)
    1. AWS Storage Gateway Volume Gateway
    2. Amazon S3 with cross-region replication
    3. Amazon EFS with AWS DataSync
    4. AWS Backup
    5. Amazon S3 Glacier

References

  1. AWS Storage Gateway – Volume Gateway User Guide
  2. Amazon S3 File Gateway User Guide
  3. Tape Gateway User Guide
  4. AWS Storage Gateway Features
  5. AWS Storage Gateway FAQs

Amazon EBS Multi-Attach

~ Last updated on : ~ jayendrapatil ~ 1 Comment

EBS Multi-Attach

  • EBS Multi-Attach enables attaching a single Provisioned IOPS SSD (io1 or io2) volume to multiple instances that are in the same AZ.
  • Multiple Multi-Attach enabled volumes can be attached to an instance or set of instances.
  • Each instance to which the volume is attached has full read and write permission to the shared volume.
  • Multi-Attach helps achieve higher application availability in clustered Linux applications that manage concurrent write operations.
  • There are no additional charges for using Amazon EBS Multi-Attach. Standard Provisioned IOPS SSD (io1 and io2) volume charges apply.

io2 Block Express with Multi-Attach

  • io2 Block Express volumes are recommended over io1 for Multi-Attach due to better performance, durability, and feature support.
  • io2 Block Express provides up to 256,000 IOPS, 4,000 MB/s throughput, and 64 TiB capacity per volume.
  • io2 Block Express offers 99.999% durability (100x higher than io1) and consistent sub-millisecond latency.
  • io2 Block Express volumes are now available in all commercial and AWS GovCloud (US) Regions (expanded in 2025).
  • Customers can upgrade from io1 to io2 Block Express without any downtime using the ModifyVolume API.
  • io2 offers up to 4x IOPS and 4x throughput at the same storage price as io1, and up to 50% cheaper IOPS cost for volumes over 32,000 IOPS.

NVMe Reservations (I/O Fencing)

  • Multi-Attach enabled io2 volumes support NVMe reservations, a set of industry-standard storage fencing protocols for data consistency.
  • NVMe reservations enable control and coordination of access from multiple instances to a shared volume.
  • NVMe reservations is enabled by default for all Multi-Attach enabled io2 volumes created after September 18, 2023.
  • For existing io2 volumes created before September 18, 2023, NVMe reservations can be enabled by detaching all instances and then reattaching them.
  • Multi-Attach enabled io1 volumes do not support I/O fencing.
  • Supported NVMe Reservation commands:
    • Reservation Register – registers, unregisters, or replaces a reservation key to associate an instance with a volume.
    • Reservation Acquire – acquires a reservation (Write Exclusive, Exclusive Access, Registrants Only, All Registrants types).
    • Reservation Release – releases or clears a reservation held on a volume.
    • Reservation Report – describes the registration and reservation status of a volume.
  • Supported operating systems for NVMe reservations:
    • Amazon Linux 2 and later
    • RHEL 8.3 and later
    • SUSE Linux Enterprise 12 SP3 and later
    • Windows Server 2016 and later (NVMe driver 1.5.0+)

EBS Multi-Attach Considerations & Limitations

  • Multi-Attach is supported exclusively on Provisioned IOPS SSD volumes (io1 and io2).
  • Multi-Attach enabled volumes can be attached to up to 16 instances built on the Nitro System that are in the same AZ.
  • Linux instances support Multi-Attach enabled io1 and io2 volumes.
  • Windows instances support Multi-Attach enabled io2 volumes only.
  • Multi-Attach for io1 volumes is available in limited Regions only: US East (N. Virginia), US West (Oregon), and Asia Pacific (Seoul). Multi-Attach for io2 is available in all Regions that support io2.
  • io1 volumes with Multi-Attach enabled are not supported with instances built on the Nitro System that support the Scalable Reliable Datagram (SRD) networking protocol only. Use io2 with these instance types.
  • Standard file systems (XFS, EXT4) are not designed to be accessed simultaneously by multiple servers. Use a clustered file system (e.g., GFS2, OCFS2) to ensure data resiliency and reliability for production workloads.
  • Multi-Attach enabled volumes can be attached to one block device mapping per instance.
  • Multi-Attach enabled volumes are deleted on instance termination if the last attached instance is terminated and if that instance is configured to delete the volume on termination.
  • Multi-Attach enabled volumes can’t be created as boot volumes.
  • Multi-Attach can’t be enabled during instance launch using either the EC2 console or RunInstances API.
  • Multi-Attach can’t be enabled or disabled while the volume is attached to an instance.
  • Multi-Attach option is disabled by default.
  • CloudWatch metrics for Multi-Attach volumes are aggregated across all attached instances. Individual instance metrics are not available.

Volume Modification Support

  • io2 Multi-Attach volumes support modifying volume size and provisioned IOPS after creation.
  • io2 Multi-Attach volumes support enabling/disabling Multi-Attach (only while the volume is detached from all instances).
  • io1 Multi-Attach volumes do not support any modifications (size, IOPS, or Multi-Attach state) after creation.
  • Volume type cannot be changed for either io1 or io2 Multi-Attach enabled volumes.

Use Cases

  • Clustered Linux Applications – High availability for applications using clustered file systems like GFS2 or OCFS2.
  • Windows Server Failover Clustering (WSFC) – io2 volumes with NVMe reservations support SQL Server Failover Cluster Instances (FCI) on Windows Server.
  • Amazon EKS Shared Storage – Multi-Attach can share persistent storage across multiple workloads in different EKS clusters within the same AZ.
  • Database High Availability – Enables faster node recovery for clustered databases (e.g., Teradata reported 95% reduction in node recovery time).

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A company runs a clustered database application on multiple EC2 instances within the same Availability Zone. The application requires shared block storage with low latency and high IOPS. The application manages concurrent write operations. Which EBS configuration meets these requirements?
    1. Use a gp3 volume and attach it to multiple instances using Multi-Attach
    2. Use an io2 volume with Multi-Attach enabled and a clustered file system
    3. Use an io1 volume without Multi-Attach and replicate data between instances
    4. Use an EFS file system mounted across all instances

    Answer: 2. Multi-Attach is only supported on Provisioned IOPS SSD volumes (io1/io2). io2 is recommended. A clustered file system is required for concurrent write access.

  2. A company wants to deploy SQL Server Failover Cluster Instances on AWS with shared storage. The solution must provide I/O fencing to prevent data corruption. Which approach should be used?
    1. Use io1 volumes with Multi-Attach enabled
    2. Use io2 volumes with Multi-Attach and NVMe reservations
    3. Use gp3 volumes with Multi-Attach enabled
    4. Use EFS with Windows Server instances

    Answer: 2. io2 volumes with Multi-Attach support NVMe reservations for I/O fencing. io1 does not support I/O fencing. gp3 does not support Multi-Attach. EFS does not support Windows natively for this use case.

  3. Which of the following statements about EBS Multi-Attach are correct? (Choose 3)
    1. Multi-Attach enabled volumes can be attached to instances across multiple AZs
    2. Multi-Attach enabled io2 volumes support NVMe reservations for I/O fencing
    3. Windows instances support Multi-Attach for io2 volumes only
    4. Multi-Attach enabled volumes can be used as boot volumes
    5. io2 Multi-Attach volumes support modification of size and IOPS after creation

    Answer: 2, 3, 5. Multi-Attach is limited to a single AZ. io2 supports NVMe reservations. Windows only supports io2 for Multi-Attach. Multi-Attach volumes cannot be boot volumes. io2 volumes support size and IOPS modifications.

  4. A solutions architect needs to provide shared block storage for a containerized application running on Amazon EKS. Instances are in a single AZ and the application requires high IOPS with consistent low latency. Which storage solution is most appropriate?
    1. Amazon EFS with Provisioned Throughput mode
    2. Amazon FSx for Lustre
    3. EBS io2 Block Express with Multi-Attach via the EBS CSI driver
    4. Instance store volumes shared via NFS

    Answer: 3. EBS io2 Block Express with Multi-Attach provides high IOPS, low latency block storage that can be shared across instances in the same AZ. The EBS CSI driver supports Multi-Attach for EKS workloads.

References

EC2 Instance Store vs EBS – Ephemeral NVMe Storage Explained

EC2 Instance Store
~ Last updated on : ~ jayendrapatil ~ 19 Comments

EC2 Instance Store

  • An instance store provides temporary or Ephemeral block-level storage for an Elastic Cloud Compute – EC2 instance.
  • is located on the disks that are physically attached to the host computer.
  • consists of one or more instance store volumes exposed as block devices.
  • The size of an instance store varies by instance type.
  • Virtual devices for instance store volumes are named ephemeral[0-23], starting the first one as ephemeral0 and so on.
  • While an instance store is dedicated to a particular instance, the disk subsystem is shared among instances on a host computer.
  • is ideal for temporary storage of information that changes frequently, such as buffers, caches, scratch data, and other temporary content, or for data that is replicated across a fleet of instances, such as a load-balanced pool of web servers.
  • delivers very high random I/O performance and is a good option for storage with very low latency requirements, but you don’t need the data to persist when the instance terminates or you can take advantage of fault-tolerant architectures.
  • Instance store volumes are included as part of the usage cost of the instance. There is no additional charge.

EC2 Instance Store

Instance Store Volume Types

  • Instance store volumes use either NVMe-based solid state drives (SSD), SATA-based SSDs, or SATA-based hard disk drives (HDD).
  • NVMe SSD – Used by most current-generation instances (e.g., C8gd, M8gd, R8gd, C8id, M8id, R8id, I7i, I8g, I8ge, M9gd). Provides the highest performance.
  • Non-NVMe SSD – Used by older instance types such as C3, I2, M3, R3, and X1.
  • HDD – Used by dense storage instances such as D2 and H1.
  • For instance types with NVMe instance store volumes, all supported instance store volumes are automatically attached at launch.
  • For instance types with non-NVMe instance store volumes (C1, C3, M1, M2, M3, R3, D2, H1, I2, X1, X1e), block device mappings must be manually specified at launch.

Instance Store Lifecycle

  • Instance store data lifetime is dependent on the lifecycle of the Instance to which it is attached.
  • Data on the Instance store persists when an instance is rebooted.
  • However, the data on the instance store does not persist if the
    • underlying disk drive fails
    • instance terminates
    • instance hibernates
    • instance stops i.e. if the EBS-backed instance with instance store volumes attached is stopped
  • Stopping, hibernating, or terminating an instance causes every block of storage in the instance store to be reset.
  • You can’t stop or hibernate instance store-backed instances.
  • If an AMI is created from an Instance with an Instance store volume, the data on its instance store volume isn’t preserved.
  • Do not rely on instance store volumes for valuable, long-term data.

Instance Store Volumes

  • Instance type of an instance determines the size of the instance store available for the instance and the type of hardware used for the instance store volumes.
  • Instance store volumes are included as part of the instance’s usage cost.
  • Some instance types use solid-state drives (SSD) to deliver very high random I/O performance, which is a good option when storage with very low latency is needed, but the data does not need to be persisted when the instance terminates or architecture is fault tolerant.
  • Instance store volume capacity varies widely by instance type:
    • General purpose (M8gd, M9gd): up to 11.4 TB NVMe SSD
    • Compute optimized (C8gd, C8id): up to 11.4–22.8 TB NVMe SSD
    • Memory optimized (R8gd, R8id): up to 11.4–22.8 TB NVMe SSD
    • Storage optimized (I7i): up to 45 TB NVMe SSD
    • Storage optimized (I8g): up to 45 TB NVMe SSD (3rd gen Nitro SSDs)
    • Storage optimized (I8ge): up to 120 TB NVMe SSD (3rd gen Nitro SSDs)

Instance Store Volumes with EC2 instances

  • EBS volumes and instance store volumes for an instance are specified using a block device mapping.
  • Instance store volume
    • can only be attached to an EC2 instance when the instance is launched.
    • cannot be detached and reattached to a different instance.
  • After an instance is launched, the instance store volumes for the instance should be formatted and mounted before it can be used.
  • Root volume of an instance store-backed instance is mounted automatically.
  • For NVMe-based instance store volumes, all volumes are automatically attached at launch — no block device mapping specification is needed.

Instance Store Encryption

  • Data on NVMe instance store volumes is encrypted at rest using an XTS-AES-256 block cipher implemented in a hardware module on the instance.
  • Encryption keys are generated using the hardware module and are unique to each NVMe instance storage device.
  • All encryption keys are destroyed when the instance is stopped or terminated and cannot be recovered.
  • You cannot disable this encryption and you cannot provide your own encryption key.
  • Some HDD instance store volumes also support encryption at rest.
  • AWS Nitro SSDs (used in I4i, I7i, I8g, I8ge, and other storage-optimized instances) provide always-on encryption as part of the hardware design.

Instance Store TRIM Support

  • Some instance types support SSD volumes with TRIM.
  • Instance store volumes that support TRIM are fully trimmed before they are allocated to the instance.
  • These volumes are not formatted with a file system when an instance launches, so you must format them before they can be mounted and used.
  • For faster access, skip the TRIM operation when initially formatting the volumes.
  • Use the TRIM command to notify the SSD controller when data is no longer needed, which provides more free space, reduces write amplification, and increases performance.
  • On Linux, use the fstrim command to enable periodic TRIM.
  • On Windows, use fsutil behavior set DisableDeleteNotify 0 to ensure TRIM support is enabled.

Instance Store Optimizing Writes

  • Because of the way that EC2 virtualizes disks, the first write to any location on an instance store volume performs more slowly than subsequent writes.
  • Amortizing (gradually writing off) this cost over the lifetime of the instance might be acceptable.
  • However, if high disk performance is required, AWS recommends initializing the drives by writing once to every drive location before production use.
  • To reduce write amplification on SSD-based instance store volumes, leave 10 percent of the volume unpartitioned for over-provisioning. This decreases usable storage but increases performance even when the disk is close to full capacity.

Detailed NVMe Performance Statistics

  • EC2 provides real-time, high-resolution performance statistics for NVMe instance store volumes attached to Nitro-based instances (launched September 2025).
  • Statistics include 11 comprehensive metrics at 1-second granularity:
    • Total read/write operations and bytes
    • Total read/write time (microseconds)
    • Volume queue length
    • Volume performance exceeded IOPS/throughput counters
    • Read/Write I/O latency histograms (broken down by I/O size)
  • Statistics are available at no additional cost.
  • Can be accessed via nvme-cli tool directly on the instance or via Amazon CloudWatch agent for monitoring and alarms.
  • Counters are not persistent across instance stops and restarts.
  • Helps identify performance bottlenecks and optimize latency-sensitive workloads.

Latest Instance Types with Instance Store (2025-2026)

  • Graviton5 (M9gd) – General purpose instances with local NVMe SSD storage, powered by AWS Graviton5 processors (June 2026). Ideal for data logging, media processing, and batch/log processing.
  • Graviton4 (C8gd, M8gd, R8gd) – Compute, general purpose, and memory optimized instances with up to 11.4 TB NVMe SSD storage, powered by AWS Graviton4 (April 2025). 30% better performance vs. Graviton3-based predecessors.
  • Intel Xeon 6 (C8id, M8id, R8id) – Up to 22.8 TB NVMe SSD storage with up to 384 vCPUs (February 2026). 43% higher performance and 3x more local storage vs. 6th generation.
  • Storage Optimized I7i – Up to 45 TB NVMe storage with PCIe Gen5-based Nitro SSDs. 50% better real-time storage performance and 50% lower I/O latency vs. I4i.
  • Storage Optimized I7ie – Up to 120 TB NVMe storage (highest density in the cloud). Up to 2x vCPUs and memory vs. prior generation.
  • Storage Optimized I8g – Graviton4-powered with 3rd generation Nitro SSDs, up to 45 TB. 65% better performance per TB and 60% lower latency variability vs. I4g (December 2024).
  • Storage Optimized I8ge – Up to 120 TB NVMe with 3rd gen Nitro SSDs. 55% better performance per TB and 75% lower I/O latency variability vs. Im4gn (August 2025).

AWS Nitro SSDs

  • AWS Nitro SSDs are custom-built by AWS specifically for cloud-scale storage workloads.
  • Provide high I/O performance, low latency, minimal latency variability, and security with always-on encryption.
  • Currently in 3rd generation, used in I8g and I8ge instance types.
  • PCIe Gen5-based Nitro SSDs are used in I7i and I7ie instances.
  • Combined with the AWS Nitro System (6th generation Nitro Cards), these offload CPU virtualization, storage, and networking functions to dedicated hardware.

EBS vs Instance Store

Refer blog post @ EBS vs Instance Store

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Please select the most correct answer regarding the persistence of the Amazon Instance Store
    1. The data on an instance store volume persists only during the life of the associated Amazon EC2 instance
    2. The data on an instance store volume is lost when the security group rule of the associated instance is changed.
    3. The data on an instance store volume persists even after associated Amazon EC2 instance is deleted
  2. A user has launched an EC2 instance from an instance store backed AMI. The user has attached an additional instance store volume to the instance. The user wants to create an AMI from the running instance. Will the AMI have the additional instance store volume data?
    1. Yes, the block device mapping will have information about the additional instance store volume
    2. No, since the instance store backed AMI can have only the root volume bundled
    3. It is not possible to attach an additional instance store volume to the existing instance store backed AMI instance
    4. No, since this is ephemeral storage it will not be a part of the AMI
  3. When an EC2 instance that is backed by an S3-based AMI Is terminated, what happens to the data on the root volume?
    1. Data is automatically saved as an EBS volume.
    2. Data is automatically saved as an EBS snapshot.
    3. Data is automatically deleted
    4. Data is unavailable until the instance is restarted.
  4. A user has launched an EC2 instance from an instance store backed AMI. If the user restarts the instance, what will happen to the ephemeral storage data?
    1. All the data will be erased but the ephemeral storage will stay connected
    2. All data will be erased and the ephemeral storage is released
    3. It is not possible to restart an instance launched from an instance store backed AMI
    4. The data is preserved
  5. When an EC2 EBS-backed instance is stopped, what happens to the data on any ephemeral store volumes?
    1. Data will be deleted and will no longer be accessible
    2. Data is automatically saved in an EBS volume.
    3. Data is automatically saved as an EBS snapshot
    4. Data is unavailable until the instance is restarted
  6. A user has launched an EC2 Windows instance from an instance store backed AMI. The user has also set the Instance initiated shutdown behavior to stop. What will happen when the user shuts down the OS?
    1. It will not allow the user to shutdown the OS when the shutdown behavior is set to Stop
    2. It is not possible to set the termination behavior to Stop for an Instance store backed AMI instance
    3. The instance will stay running but the OS will be shutdown
    4. The instance will be terminated
  7. Which of the following will occur when an EC2 instance in a VPC (Virtual Private Cloud) with an associated Elastic IP is stopped and started? (Choose 2 answers)
    1. The Elastic IP will be dissociated from the instance
    2. All data on instance-store devices will be lost
    3. All data on EBS (Elastic Block Store) devices will be lost
    4. The ENI (Elastic Network Interface) is detached
    5. The underlying host for the instance is changed
  8. Which of the following statements about EC2 instance store NVMe encryption is correct? (Choose 2 answers)
    1. You can provide your own encryption key for instance store NVMe volumes
    2. Data on NVMe instance store volumes is encrypted using XTS-AES-256 cipher in hardware
    3. Encryption keys persist after the instance is terminated for data recovery
    4. Encryption keys are unique per device and destroyed when the instance stops or terminates
    5. Instance store encryption must be enabled manually via the AWS Console
  9. A company needs temporary high-performance storage with up to 120 TB capacity and the lowest possible I/O latency for a real-time analytics workload on AWS. Which EC2 instance family should they choose?
    1. R8gd instances with up to 11.4 TB NVMe storage
    2. I7i instances with up to 45 TB NVMe storage
    3. I8ge instances with up to 120 TB NVMe storage and 3rd gen Nitro SSDs
    4. C8id instances with up to 22.8 TB NVMe storage
  10. Which feature allows you to monitor NVMe instance store volume performance at 1-second granularity on Nitro-based EC2 instances?
    1. Amazon EBS CloudWatch Metrics
    2. EC2 Detailed NVMe Performance Statistics
    3. AWS CloudTrail storage events
    4. Amazon Inspector performance assessment

References