Based on the DVA-C02 exam guideReport an error

DVA-C02· AssociateWeek 5 · Day 5~46 min read

Day 5 - S3 Advanced Features + Week 5 Comprehensive Review

This is the last day of Week 5. We'll finish looking at three advanced features — S3 event notifications, Presigned URLs, and static website hosting — and then organize everything about S3 we learned over the past four days from an exam perspective. S3 is one of the services with the most questions on the DVA-C02. If you understand "why it works that way" rather than just memorizing, you won't be shaken by variant questions.

S3 Event Notifications — What Happens When a File Arrives

An S3 event notification is the pattern of "when something specific happens in the bucket, notify someone." This pattern is at the heart of serverless architecture — when a file is uploaded to S3, Lambda runs automatically, and image resizing, document conversion, and data validation take place.

Supported event types:

s3:ObjectCreated:* — includes PUT, POST, COPY, and multipart completion all together
s3:ObjectCreated:Put — PUT only
s3:ObjectRemoved:* — deletion and delete-marker creation
s3:ObjectRestore:* — Glacier restore start/complete
s3:Replication:* — replication failure, incomplete, etc.

Three direct-connection targets: Lambda function, SQS queue, SNS topic.

The method of going through Amazon EventBridge was added in 2021, and this approach is currently the most recommended. The reason is that it enables event archiving, replay, more than 18 targets (Step Functions, Kinesis, API Gateway, CodePipeline, etc.), and fine-grained event-pattern filtering (prefix, suffix, size conditions, etc.).

Use direct connection (Lambda/SQS/SNS) when the target is already clear and simple, and use EventBridge when flexibility is needed — that's the selection criterion.

💡 Related theory: S3 event notifications are a classic implementation of event-driven architecture (EDA). Since Amazon's internal transition to SOA (Service-Oriented Architecture) in 2003, AWS services have made communicating through events a basic design principle. S3 events guarantee at-least-once delivery but allow duplicate delivery — this is why you must ensure idempotency in a Lambda or SQS consumer.

⚠️ Trap: S3 event notifications are "at-least-once" delivery, not "exactly-once." Lambda can be invoked twice for the same PUT. You must implement idempotent processing within Lambda (such as a DynamoDB item that checks whether a file has already been processed).

Presigned URL — How to Embed IAM Permissions in a URL

A Presigned URL is a temporary URL signed using the creator's IAM credentials. Whoever receives the URL can perform S3 operations with the creator's permissions while the URL is valid.

import boto3
from datetime import datetime, timedelta
 
s3 = boto3.client('s3')
 
# 1. Temporary sharing of a private file (GET)
download_url = s3.generate_presigned_url(
    'get_object',
    Params={
        'Bucket': 'my-private-bucket',
        'Key': 'confidential/report-2026.pdf'
    },
    ExpiresIn=3600  # valid for 1 hour
)
 
# 2. Client uploads directly to S3 without going through the server (PUT)
upload_url = s3.generate_presigned_url(
    'put_object',
    Params={
        'Bucket': 'my-upload-bucket',
        'Key': f'user-uploads/{user_id}/avatar.jpg',
        'ContentType': 'image/jpeg'
    },
    ExpiresIn=300  # valid for 5 minutes
)
 
# 3. POST-form Presigned URL (HTML form upload)
response = s3.generate_presigned_post(
    Bucket='my-bucket',
    Key='uploads/${filename}',  # variables can be used
    Fields={'Content-Type': 'image/jpeg'},
    Conditions=[
        ['content-length-range', 1, 10 * 1024 * 1024]  # max 10MB
    ],
    ExpiresIn=600
)

Key characteristics of a Presigned URL:

Expiration time: up to 7 days if IAM-user-based, and up to 12 hours if IAM-role-based (STS temporary credentials) (limited by the STS token's expiration time). On the exam, there are cases where the correct answer is "up to 1 hour" rather than "up to 7 days" — if you generated it with an IAM role from Lambda or EC2, the STS token TTL (up to 12 hours) becomes the limit.

Creator permission: at the time the URL is generated, the creator must hold the permission for that operation. Even if the permission existed at creation time, if the permission is later removed by an IAM policy change, the URL also stops working.

PUT Presigned URL pattern: the server generates the URL and passes it to the client, and the client uploads the file directly to S3. The server does not process the file data, so there is no bandwidth load. When the file upload completes, the client sends a completion notification to the server, and the server checks the S3 event or DynamoDB metadata.

🔍 Going deeper: A Presigned URL's signature is generated with the AWS SigV4 (Signature Version 4) algorithm. SigV4 uses HMAC-SHA256, and the request's HTTP method, bucket/key, expiration time, allowed headers, etc. are included in the signature. If you tamper with the URL, signature verification fails. The SDK's generate_presigned_url abstracts away this complex process.

Static Website Hosting — The Fundamental Reason It Supports HTTP Only

An S3 static website is cost-effective but has an important constraint: it supports HTTP only. You cannot install a TLS certificate on S3 itself. To provide HTTPS, the combination of CloudFront + ACM (AWS Certificate Manager) is required.

Why HTTP only? S3 is object storage, not a web server. The complex elements of HTTPS — TLS handshake, certificate management, SNI (Server Name Indication) — are the role of Layer 7 services like CloudFront or ALB. AWS maintains this as a principle of separating roles by service.

Static website URL formats (both appear on the exam):

http://bucket-name.s3-website-region.amazonaws.com
http://bucket-name.s3-website.region.amazonaws.com

Static website + HTTPS architecture:

[User browser]
      ↕ HTTPS (ACM certificate)
[CloudFront distribution]
      ↕ HTTP (S3 website endpoint)
      or
      ↕ S3 origin + OAC (recommended)
[S3 bucket]

With the CloudFront + OAC method (recommended), you don't have to open the bucket to public. Only CloudFront accesses the bucket and serves users over HTTPS.

⚠️ Trap: The public URL of S3 static website hosting differs from that of a regular S3 bucket. The website endpoint (s3-website) of a bucket with website hosting enabled renders HTML files in the browser. A regular S3 URL (s3.amazonaws.com) can process the file as a download (Content-Disposition: attachment). You must turn on the static website feature to serve index.html as the default document and to configure an error page.

Full Week 5 Review — DVA-C02 Core Summary

S3 Basic Specs (must memorize)

Maximum object size:      5TB
Single PUT maximum:       5GB (multipart required if exceeded)
Multipart minimum:        100MB recommended, required at 5GB+
Part minimum size:        5MB (except the last part)
Part maximum count:       10,000
Throughput per prefix:    PUT 3,500/s, GET 5,500/s
Durability:               11 nines (same for all classes)
Standard availability:    99.99%
One Zone-IA availability: 99.5%

Storage Class Core Comparison

Class	Minimum retention	Immediate retrieval	AZ	Core use case
Standard	None	✅	3+	Frequent access
Intelligent-Tiering	None	✅*	3+	Irregular access
Standard-IA	30 days	✅	3+	Less than once a month
One Zone-IA	30 days	✅	1	Regenerable
Glacier Instant	90 days	✅	3+	Once a quarter
Glacier Flexible	90 days	❌ (1 min–12 hours)	3+	1–2 times a year
Glacier Deep Archive	180 days	❌ (12–48 hours)	3+	Long-term regulatory

*In Intelligent-Tiering, retrieval delay occurs when the Archive Access tier is enabled.

Versioning Core Points

States: Unversioned → Enabled → Suspended (cannot be disabled)
Delete = add a delete marker (not a real deletion)
Real deletion = DELETE + explicit version ID
MFA Delete: only the root account can set/release it
Cost trap: previous versions all incur storage cost
Solution: NoncurrentVersionExpiration lifecycle rule

Encryption Methods Summary

SSE-S3:    AWS fully managed, default, free, no audit log
SSE-KMS:   KMS key policy, CloudTrail auditing, watch out for KMS API limits
           → cut KMS cost by up to 99% with S3 Bucket Key
DSSE-KMS:  dual encryption, FIPS 140-3 Level 3, government/defense
SSE-C:     customer provides the key, HTTPS required, key not stored on AWS
CSE:       client encrypts directly, highest security

Replication Core

CRR: different region → disaster recovery, latency optimization
SRR: same region → dev/staging separation, log aggregation
Requirement: versioning must be enabled on both sides
Existing objects: use Batch Replication separately
Delete markers: not replicated by default (optionally enabled)
RTC: guarantees 99.99% replicated within 15 minutes (paid SLA)

Security Layer Priority

① Account/bucket-level Block Public Access (highest priority)
② Explicit Deny (bucket policy, SCP)
③ Resource-based Allow (bucket policy) + IAM Allow
④ ACL (ignored when Bucket Owner Enforced is set)

Event Notifications vs. EventBridge

Direct connection (Lambda/SQS/SNS): simple, fast, 3 target types
Via EventBridge: flexible, 18+ targets, archiving, replay, fine-grained filtering
Currently recommended: via EventBridge

20 Week 5 Exam Traps

Bucket name globally unique — unique worldwide, not just within the same region
Bucket name with dots — technically valid, but breaks the HTTPS certificate wildcard
S3 is Strong Consistency since 2020 — saying "eventual" is wrong
One Zone-IA can lose data on an AZ failure — regenerable data only
Minimum retention is billed even on early deletion — IA 30 days, Glacier 90 days, Deep Archive 180 days
Glacier Deep Archive minimum object size 40KB — IA is 128KB
Versioning cannot be disabled — only Suspended is possible
Deletion = delete marker — permanent deletion requires an explicit version ID
MFA Delete = root account only — an administrator IAM user cannot either
Replication = versioning required on both sides — existing objects via Batch Replication
2023+ all new objects SSE-S3 by default — "encrypted?" → "always yes"
SSE-KMS KMS API limits → cut by 99% with Bucket Key
New buckets have all 4 Block Public Access ON by default + Bucket Owner Enforced
OAI legacy, OAC currently recommended — serving SSE-KMS objects via CloudFront = OAC required
Single PUT maximum 5GB — multipart required if exceeded
Incomplete multipart parts incur storage cost → AbortIncompleteMultipartUpload lifecycle rule
Static website HTTP only → HTTPS requires CloudFront + ACM
IAM-role-based Presigned URL is up to 12 hours — STS token TTL limit
EventBridge is the most flexible for event notifications — 18+ targets, archiving, replay
S3 Select is single file, simple SQL only — complex queries via Athena

Week 5 Acronym Summary

Acronym	Full name	Core point
S3	Simple Storage Service	Object storage
IA	Infrequent Access	30-day minimum
CRR/SRR	Cross/Same Region Replication	Versioning required on both sides
RTC	Replication Time Control	15-minute SLA
MRAP	Multi-Region Access Point	Single global endpoint
OAC/OAI	Origin Access Control/Identity	OAC is currently recommended
BPA	Block Public Access	Highest-priority security layer
SSE	Server-Side Encryption	Server-side encryption
CSE	Client-Side Encryption	Client-side encryption
DSSE	Dual-layer SSE	Dual encryption
WORM	Write Once Read Many	Object Lock
MPU	Multipart Upload	100MB+ recommended
ETag	Entity Tag	Object integrity hash
CORS	Cross-Origin Resource Sharing	Needed for direct S3 access from the browser
ACM	AWS Certificate Manager	HTTPS certificate management

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

A company's medical imaging data must be retained for 10 years per regulations. It is accessed frequently for the first year, then almost never, but requires immediate lookup during an audit. What is the most cost-effective lifecycle design?

Question 2

A mobile app user needs to upload a profile photo. You want to avoid the server bearing the load of processing large file data. What is the most suitable architecture?

Question 3

In AWS Organizations, you want to forcibly keep Block Public Access maintained on all S3 buckets. Which service do you use?

Question 4

In an architecture where an S3 event notification invokes Lambda on object upload, the same file triggered Lambda twice within a short period. What is the cause and solution of this phenomenon?

Question 5

A company providing a global service hosts a static web application on S3. The requirements are HTTPS required, global optimization, and a custom domain for SEO. Which architecture is correct?

Question 6

On an S3 bucket, a lifecycle policy is set to "transition to Standard-IA after 30 days, to Glacier Flexible after 90 days." On the 50th day, you deleted the object. What fee is billed?

Question 7

A dev team needs a Lambda in a different AWS account to access a Lambda deployment package stored in S3. What is the most secure way to grant access without opening the S3 bucket to public?

Question 8

Which is correct as the default setting of every new S3 bucket as of 2024?

Question 9

An S3 bucket has billions of objects, and you must find the objects among all of them that do not have SSE-KMS encryption applied and apply encryption to them in bulk. Which method is suitable?

Question 10

Choose the correct solution for the following scenario. "A company's partner needs to upload files to a specific S3 bucket. The partner does not have an AWS account."

Question 11

You set up CRR from S3 bucket A (us-east-1) to bucket B (ap-northeast-2). In bucket A, you permanently deleted an object directly (with an explicit version ID) without a delete marker. What about bucket B?

Question 12

Select 2 answers

Which of the following are all correct descriptions of an S3 Access Point?

Official references