AWS for DevOps — Storage Exercises

5.6 — Practice Exercises

Test your understanding of S3, EBS, and EFS.

---

Exercise 1 — S3 Artefact Bucket

Create an S3 bucket for CI/CD artefacts with versioning, encryption, and public access blocked. Upload a file, then upload it again and list both versions.

Show Answer

# Create bucket
$ aws s3 mb s3://my-cicd-artefacts-exercise --region ap-south-1

# Block public access
$ aws s3api put-public-access-block \
    --bucket my-cicd-artefacts-exercise \
    --public-access-block-configuration \
        'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'

# Enable encryption
$ aws s3api put-bucket-encryption \
    --bucket my-cicd-artefacts-exercise \
    --server-side-encryption-configuration '{
        "Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]
    }'

# Enable versioning
$ aws s3api put-bucket-versioning \
    --bucket my-cicd-artefacts-exercise \
    --versioning-configuration Status=Enabled

# Upload v1
$ echo "version 1" > app.txt
$ aws s3 cp app.txt s3://my-cicd-artefacts-exercise/app.txt

# Upload v2
$ echo "version 2" > app.txt
$ aws s3 cp app.txt s3://my-cicd-artefacts-exercise/app.txt

# List versions
$ aws s3api list-object-versions \
    --bucket my-cicd-artefacts-exercise \
    --prefix app.txt \
    --query 'Versions[*].[VersionId,IsLatest,LastModified]'

---

Exercise 2 — Lifecycle Policy

Write a lifecycle policy for an artefact bucket that moves objects to Standard-IA after 30 days, to Glacier after 90 days, and deletes them after 365 days. Old versions should be deleted after 14 days.

Show Answer

{
  "Rules": [
    {
      "ID": "ArtefactLifecycle",
      "Status": "Enabled",
      "Filter": {},
      "Transitions": [
        {"Days": 30, "StorageClass": "STANDARD_IA"},
        {"Days": 90, "StorageClass": "GLACIER"}
      ],
      "Expiration": {"Days": 365},
      "NoncurrentVersionExpiration": {"NoncurrentDays": 14}
    }
  ]
}

$ aws s3api put-bucket-lifecycle-configuration \
    --bucket my-cicd-artefacts-exercise \
    --lifecycle-configuration file://lifecycle.json

Cost savings: A 100 GB bucket costs ~$2.30/month in Standard. After 30 days in Standard-IA, it costs ~$1.25/month. After 90 days in Glacier, it costs ~$0.40/month.

---

Exercise 3 — EBS Snapshot and Restore

Create a snapshot of an EBS volume, then create a new volume from that snapshot in a different AZ. Explain when this is useful.

Show Answer

# Create snapshot
$ aws ec2 create-snapshot \
    --volume-id vol-abc123 \
    --description "Pre-deployment backup" \
    --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=pre-deploy}]'
{
    "SnapshotId": "snap-xyz789"
}

# Wait for completion
$ aws ec2 wait snapshot-completed --snapshot-ids snap-xyz789

# Create new volume in a different AZ
$ aws ec2 create-volume \
    --snapshot-id snap-xyz789 \
    --availability-zone ap-south-1b \
    --volume-type gp3 \
    --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=restored-data}]'

When this is useful:

• Disaster recovery — restore data in a different AZ if the original AZ has issues
• Migration — move an instance’s data to a different AZ
• Testing — create a copy of production data for testing
• Before deployments — snapshot before risky changes, restore if something goes wrong

---

Exercise 4 — S3 Presigned URL

Generate a presigned URL that allows someone to download a build artefact for 2 hours without AWS credentials. Explain the security implications.

Show Answer

$ aws s3 presign s3://my-cicd-artefacts-exercise/releases/v1.2.3/app.tar.gz \
    --expires-in 7200
https://my-cicd-artefacts-exercise.s3.amazonaws.com/releases/v1.2.3/app.tar.gz?X-Amz-Algorithm=...&X-Amz-Expires=7200&...

Security implications:

• Anyone with the URL can download the file — treat it like a password
• The URL expires after 2 hours — limits the window of exposure
• Share only over secure channels (HTTPS, encrypted chat)
• The URL inherits the permissions of the IAM user/role that generated it
• If the generating credentials are revoked, the URL stops working immediately

---

Exercise 5 — Choose the Right Storage

For each scenario, recommend S3, EBS, or EFS and explain why:

1. Storing Terraform state files
2. A PostgreSQL database on EC2
3. Shared config files for an Auto Scaling Group
4. CI/CD build artefacts
5. A Docker volume for an ECS Fargate task

Show Answer

Scenario	Storage	Why
Terraform state	S3	Durable, versioned, supports DynamoDB locking, accessible from anywhere
PostgreSQL on EC2	EBS (io2 or gp3)	Block storage with consistent IOPS, database needs a file system
Shared config for ASG	EFS	Multiple instances need simultaneous read access across AZs
CI/CD artefacts	S3	Object storage, easy to organise by version, lifecycle policies for cost
ECS Fargate Docker volume	EFS	Fargate doesn’t support EBS; EFS is the supported persistent storage option

Key decision factors:

• Need block storage (file system)? → EBS
• Need shared access across instances? → EFS
• Need object storage, accessible via HTTP? → S3
• Need to mount in a container? → EFS (or S3 via sidecar)

---

Next Chapter → CI/CD on AWS