SAA-C03 · S3 and Storage Patterns

Exam domain: Design High-Performing Architectures (24%)

S3 storage classes

Class	Availability	Retrieval	Min. billed duration	Use case
S3 Standard	4 nines	ms	—	Hot data
S3 Intelligent-Tiering	3 nines	ms (auto)	—	Access pattern unknown
S3 Standard-IA	3 nines	ms	30 days	Warm, infrequent
S3 One Zone-IA	99.5%	ms	30 days	Recreatable, warm
S3 Glacier Instant Retrieval	3 nines	ms	90 days	Archival, rare-but-fast reads
S3 Glacier Flexible Retrieval	3 nines	1–12 h	90 days	Backups, DR
S3 Glacier Deep Archive	3 nines	12–48 h	180 days	Compliance archives

Intelligent-Tiering vs a hand-written lifecycle policy

Intelligent-Tiering costs a small per-object monitoring fee. If you know the access pattern (logs, images), a lifecycle policy is cheaper. If you don’t (mixed workloads, user data), let Intelligent-Tiering do it.

Lifecycle policy

lifecycle.json

{
  "Rules": [
    {
      "ID": "tier-then-archive",
      "Filter": { "Prefix": "logs/" },
      "Status": "Enabled",
      "Transitions": [
        { "Days": 30,  "StorageClass": "STANDARD_IA" },
        { "Days": 180, "StorageClass": "GLACIER" }
      ],
      "Expiration": { "Days": 730 }
    }
  ]
}

Encryption — the four options

What actually differs

• SSE-S3 — S3 manages the key. Zero-config. Default since 2023.
• SSE-KMS — KMS-managed CMK. Audit trail via CloudTrail. Charge per KMS call.
• DSSE-KMS — Dual-layer server-side. Bureaucratic use cases only.
• SSE-C — Customer-supplied key (over TLS). You store the key. Rarely a good answer.

Bucket-key

For SSE-KMS at scale, enable S3 Bucket Keys — it caches a data key locally, dropping KMS API calls by up to 99%. Real cost savings on chatty buckets.

Replication

CRR

Cross-Region Replication — async copy to a different Region. Good for DR, compliance, low-latency reads in another Region.

SRR

Same-Region Replication — async copy within a Region. Aggregate logs from many buckets, replicate to a “compliance” account.

RTC

Replication Time Control — SLA-backed: 15-min replication for 99.99% of objects. Extra cost. Reach for it when the exam mentions RPO in minutes.

EBS vs EFS vs FSx

Service	Type	Attach	Typical use
EBS	Block	Single-AZ EC2 (Multi-Attach for io1/io2)	Root volume, databases
EFS	NFS	Multi-AZ, many EC2	Shared web assets, CMS
FSx Lustre	Parallel FS	HPC clusters	HPC, ML training
FSx Windows	SMB	Windows fleets	AD-integrated file shares
FSx NetApp ONTAP	Multi-protocol	Enterprise workloads	Snapshotting, cross-region

Gotcha: EBS is AZ-local

An EBS volume can only be attached to instances in the same AZ. Snapshot → copy → restore into a new AZ if you’re doing cross-AZ moves.

S3 request patterns

• Prefix scaling is automatic since 2018 — 5,500 GET/s and 3,500 PUT/s per prefix.
• Hot prefix? Split by hashing ({md5(key)[0..3]}/rest-of-key).
• Multipart upload for objects > 100 MB (mandatory > 5 GB).
• Transfer Acceleration goes through CloudFront edge — pay a premium for global uploads.