Lesson 05 of 7 · Modules
Storage
Choose and use AWS storage well: S3 for objects (classes, versioning, lifecycle, access control), EBS for block volumes (gp3, snapshots, AZ scope), EFS for shared files, and instance store for scratch.
Three kinds of storage, plus scratch
| Service | Kind | Scope | Typical use |
|---|---|---|---|
| S3 | Objects (HTTP API) | Region | Backups, artifacts, logs, data lakes, static sites, Terraform state |
| EBS | Block volumes | One AZ | Instance disks, databases, Kubernetes RWO volumes |
| EFS | Shared filesystem (NFS) | Region (multi-AZ) | Shared content, Kubernetes RWX volumes |
| Instance store | Local NVMe | One instance | Caches, scratch: lost when the instance stops |
S3 is a giant warehouse: you hand in boxes with labels and get them back by label, from anywhere. EBS is a hard drive plugged into one computer in one room. EFS is a shared network drive everyone in the building can use. The instance store is a whiteboard in the room, wiped clean when you leave.
S3 essentials
- Buckets hold objects addressed by key (
prod/config.json). There are no real folders; prefixes just look like them. - Storage classes trade cost for access patterns: Standard, Intelligent-Tiering, Standard-IA, Glacier tiers. Lifecycle rules move or expire objects automatically.
- Versioning keeps old versions (protection against overwrites and deletes); pair it with lifecycle rules to expire old versions.
- Block Public Access (on by default for new buckets) prevents accidental public exposure. Keep it on unless the bucket is deliberately public.
- Encryption: objects are encrypted at rest by default (SSE-S3); use SSE-KMS when you need key-level control and audit.
- Object Lock makes objects immutable for a retention period, which is valuable for backups (ransomware protection).
EBS essentials
| Type | Performance | Use |
|---|---|---|
| gp3 | Baseline 3,000 IOPS / 125 MB/s, both adjustable independently of size | Default for most workloads |
| gp2 | IOPS scale with size | Legacy; migrate to gp3 (usually cheaper) |
| io2 | High, consistent provisioned IOPS | Demanding databases |
| st1 / sc1 | Throughput-optimised HDD | Big sequential data, cold data |
- AZ-scoped: a volume attaches to instances in its own AZ only.
- Snapshots are incremental and stored regionally; restore them in any AZ, or copy them to other regions and accounts for DR.
- Modify online: change type, size, IOPS and throughput without detaching (the filesystem still needs growing).
- Encryption: enable default EBS encryption per region so every new volume is encrypted.
EFS essentials
A managed NFS filesystem, multi-AZ, grows automatically, mountable by many clients at once. Great for shared files and Kubernetes RWX; higher latency than EBS, and priced per GB used (with cheaper infrequent-access tiers).
Try it: storage behaviour (sandbox account)
- Create a bucket with versioning on. Upload
config.json, overwrite it, delete it, then list versions (aws s3api list-object-versions) and restore the first version. - Add a lifecycle rule that expires non-current versions after 30 days.
- Create a 10 GiB gp3 volume in one AZ; try to attach it to an instance in another AZ (fails). Snapshot it and restore the snapshot in the other AZ.
- Change the volume from gp3 3,000 IOPS to 6,000 IOPS online.
- Create an EFS filesystem with mount targets in two AZs and mount it from two instances at once; write from one, read from the other. Clean everything up afterwards.
Going deeper: storage on AWS for platforms
- Use the EBS CSI and EFS CSI drivers for Kubernetes (see Amazon EKS in Production); gp3 StorageClasses with
WaitForFirstConsumer. - Keep Terraform state and backups in S3 with versioning, encryption, Block Public Access and, for backups, Object Lock, in a separate account.
- Watch S3 request costs and data transfer, not only storage GB; millions of small objects or cross-region reads add up.
- Snapshot lifecycle: automate with Data Lifecycle Manager or AWS Backup, with retention and cross-region copies.
Recap
- S3 = objects (versioning, lifecycle, Block Public Access, encryption, Object Lock).
- EBS = zonal block volumes: gp3 by default, snapshots for backup and moving AZs, online modifications.
- EFS = shared multi-AZ NFS (RWX); instance store = fast, ephemeral scratch.
This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.