Storage — S3, EBS & RDS

Storage — S3, EBS & RDS

Three Storage Layers

S3 in Depth

S3 stores objects (files) in buckets. Every object has a key (the "path"), a value (the bytes), and metadata.

Bucket: my-app-assets
Objects:
  uploads/profile-pic-123.jpg
  exports/report-2024-01.csv
  public/index.html

Durability and availability: S3 automatically stores objects across at least 3 AZs. 11 nines durability means if you store 10 million objects, you can expect to lose one object every 10,000 years.

Access control — the most important S3 topic:

S3 has three layers of access control:

1. Block Public Access — account-level switch, on by default, prevents any public access regardless of policies. Never turn this off unless you explicitly need a public bucket.
2. Bucket Policy — JSON policy attached to the bucket. Controls who can do what.
3. Object ACLs — per-object permissions. Largely deprecated; use bucket policies instead.

A bucket policy that allows public read (for a static website):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-static-site/*"
    }
  ]
}

Pre-signed URLs — time-limited URLs that grant temporary access to a private object without changing the bucket policy. Use for user file uploads and downloads.

// Generate a pre-signed URL (expires in 1 hour)
import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3'
import { getSignedUrl } from '@aws-sdk/s3-request-presigner'

const client = new S3Client({ region: 'us-east-1' })
const url = await getSignedUrl(
  client,
  new GetObjectCommand({ Bucket: 'my-bucket', Key: 'file.pdf' }),
  { expiresIn: 3600 }
)

EBS in Depth

EBS volumes are block devices — like virtual hard drives. They live in a specific AZ and can only be attached to EC2 instances in the same AZ.

Volume types:

• gp3 — General Purpose SSD. The default. 3,000 IOPS baseline, configurable up to 16,000.
• io2 — Provisioned IOPS SSD. For databases needing >16,000 IOPS or Multi-Attach.
• sc1/st1 — HDD volumes. Cheapest; for infrequently accessed data.

EBS volumes persist independently of the EC2 instance lifecycle. You can detach a volume, attach it to another instance, or take a snapshot.

RDS in Depth

RDS gives you a fully managed relational database. You pick the engine (Postgres, MySQL, etc.), instance class, and storage. AWS handles:

• OS and database engine patching
• Automated backups (point-in-time recovery up to 35 days)
• Failover with Multi-AZ
• Read replicas for horizontal read scaling

Multi-AZ vs. Read Replicas:

Connection tip: applications connect to the RDS endpoint (a DNS name). Multi-AZ failover keeps the same endpoint — your app reconnects automatically without config changes.