Amazon DVA-C02: Storage, Amazon S3, CloudFront & File Systems (EFS, FSx) — Study Guide
Part of the AWS Developer Associate DVA-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Amazon S3 fundamentals, security controls, and developer patterns
Amazon S3 is the canonical durable object store. Developers should design APIs around PutObject/GetObject/HeadObject and multipart uploads (CreateMultipartUpload, UploadPart, CompleteMultipartUpload) for large payloads, and use SDK helpers like boto3’s generate_presigned_url(‘get_object’) or generate_presigned_post for temporary client uploads. Secure objects using server-side encryption (SSE-S3, SSE-KMS via PutObject with x-amz-server-side-encryption or by enforcing bucket default encryption with PutBucketEncryption), require TLS by enforcing aws:SecureTransport in bucket policies, and block accidental public access with S3 Block Public Access and explicit bucket policy denies. Common traps include IAM explicit denies taking precedence over role permissions, presigned URLs inheriting the signer’s privileges but still being subject to bucket policies and VPC endpoint policies, and CORS misconfigurations when uploading directly from browsers (configure PutBucketCors). Use lifecycle rules (PutBucketLifecycleConfiguration) to transition to Intelligent-Tiering, GLACIER, or expire noncurrent versions, and enable versioning (PutBucketVersioning) before relying on noncurrent-version rules. For audit and recovery, enable S3 server access logs or S3 Access Points, and use Object Lock with a retention mode for immutable retention. Architect for eventual consistency of overwrite PUTs to new keys (read-after-write is guaranteed for PUT of new objects, but updates to existing keys can exhibit eventual consistency in edge scenarios).
Advanced S3: Object Lambda, presigned flows, policies, and lifecycle nuance
S3 Object Lambda lets you transform GetObject responses by attaching a Lambda function to an S3 Object Lambda Access Point; the Lambda receives a GetObjectContext and must call WriteGetObjectResponse (via the S3 Object Lambda/Control API) to return transformed bytes. Typical patterns are on-the-fly image resizing, redaction, or format conversion without duplicating objects. For browser uploads, generate presigned POSTs (generate_presigned_post in SDKs) with a constrained policy (content-length-range, key prefix) to avoid abuse. Bucket policies and VPC Gateway/Interface endpoint policies are powerful for restricting access: prefer explicit allow + resource conditions (aws:SourceVpce, aws:Referer cautiously) and avoid open wildcard principals. Lifecycle gotchas include transitions for versioned buckets—configure noncurrentVersionTransitions and noncurrentVersionExpiration explicitly—and abort-incomplete-multipart-upload to avoid storage leakage. When enforcing in-transit encryption, require x-amz-server-side-encryption or use PutBucketPolicy to deny requests without tls. For immutable compliance, enable Object Lock before uploading objects. When requiring programmatic enforcement, combine S3 events (SNS, EventBridge) with Lambda to apply tags or perform post-upload validation.
CloudFront, caching strategies, and edge compute (Lambda@Edge vs CloudFront Functions)
CloudFront accelerates global delivery and protects origins. For S3 origins, prefer Origin Access Control (OAC) with Sigv4 over legacy Origin Access Identity to sign origin requests and deny direct S3 public access. Cache behavior tuning uses Cache-Control/Expires, Authorization header forwarding, and query-string/cookie-based cache keys; favor cache key whitelisting or Cache Policy & Origin Request Policy to reduce cache fragmentation. For private content use CloudFront signed URLs or signed cookies (create via cloudfront.create_signer or SDK helpers). Use CloudFront Functions for sub-millisecond lightweight manipulations (viewer request/response) and Lambda@Edge for heavier logic requiring Node/Python runtimes and origin-request or origin-response hooks; remember Lambda@Edge functions are deployed from us-east-1 and have cold-start implications and regional replication delay. Invalidation has cost and latency—prefer object key versioning (deploy new filenames or add query-string version) to avoid invalidations. Instrument CloudFront with real-time logs and CloudWatch metrics for near-real-time anomaly detection, and trigger Lambda for automated responses. Common traps include over-forwarding headers/cookies that bust the cache and assuming immediate invalidation propagation.
Shared file systems: EFS and FSx decision criteria, mounts, and pitfalls
Choose EFS for POSIX-compliant, concurrently mounted NFSv4.1 file systems across Linux clients; choose FSx variants when you need SMB/Windows features or high-performance Lustre. EFS supports encryption at rest via KMS, encryption in transit using the TLS mount option, and access points for per-application UID/GID mapping. Mount using amazon-efs-utils (mount -t efs -o tls,accesspoint=fsap-0123456789 fs-12345678:/ /mnt) or the NFS client for high-throughput workloads. Select performance mode generalPurpose vs maxIO and throughput mode bursting vs provisioned based on throughput/IOPS patterns. FSx for Windows integrates with Active Directory and exposes SMB shares with NTFS ACLs, DFS namespaces, and native Windows semantics—mount using net use \fs-xxxx\share or via EC2 Windows clients; common pitfalls include AD join complexity and DNS resolution. FSx for Lustre is ideal for high-performance compute and can transparently link to S3 via data repository tasks to import/export datasets. Networking gotchas: open NFS/SMB ports in security groups, use mount targets in each AZ for EFS, and ensure IAM policies can’t be used to restrict NFS-level access—POSIX permissions and security groups are the enforcement points. For backups, prefer automated snapshots (EFS Backup, FSx snapshots) and test restores regularly.
Practical Problem: Use-Case Scenario
Scenario: AcmeAnalytics runs a customer-facing static dashboard hosted in an S3 bucket and served globally via a CloudFront distribution. The engineering team needs to serve private data files, perform on-the-fly CSV-to-JSON conversion for some objects, and ensure new dashboard builds invalidate caches with minimal cost.
Challenge: Implement secure private object delivery, dynamic transformation without duplicating storage, and a low-cost strategy for cache updates.
Recommended Approach:
- Create an S3 bucket with PutBucketEncryption (SSE-KMS) and PutBucketPolicy to deny non-TLS and to allow access only from the CloudFront Origin Access Control (create OAC and attach to distribution); use PutBucketVersioning to enable versioning.
- Configure an S3 Object Lambda Access Point; implement a Lambda that handles the GetObjectContext, retrieves the original via S3 GetObject, transforms CSV to JSON in-memory, and returns the result using s3control.write_get_object_response.
- Configure CloudFront cache behaviors: route /private/* to the S3 Object Lambda Access Point (as an origin), set a Cache Policy that caches based on the Accept header if necessary, and enable minimum TTLs; for dashboard assets use versioned filenames to avoid invalidations.
- For infrequent necessary invalidations, call cloudfront.create_invalidation(DistributionId=…, InvalidationBatch={…}) from CI after deploy; otherwise, for routine changes, upload assets with a content-hash in the filename to bypass invalidation costs.
Rationale: Restricting S3 access to CloudFront via OAC and enforcing SSE-KMS secures data in-flight and at-rest. S3 Object Lambda provides on-the-fly transformation without duplicating objects, and using object versioning or content-hashed filenames avoids expensive invalidations while preserving cache efficiency.
← Monitoring · All domains · Databases →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →