Amazon S3 功能介绍

谁借莪１个温暖的怀抱￠ 2021-11-10 15:20 248阅读 0赞

# [Amazon S3 功能介绍][Amazon S3] #

## 1 存储过程 ##

创建用于存储数据元的桶，可以选择数据元所驻留的地区（目前来说，选择东京、新加坡会快些，美国本土更便宜），上传数据元到桶，进行持久化存储。另外，可以对上传的数据元及桶进行访问控制、加密等设置。每个AWS账户可以创建多个用户，用户可以对所拥有的数据进行上述权限控制。

目前可存储的你内容有：

(1)多媒体、音乐、图片

(2)视频监控文件

(3)医疗系统的档案、资料

(4)静态网站资料

## 2 管理 ##

通过AWS管理控制台对数据进行控制。AWS控制台类似于EC2的web控制界面，或者通过API接口(Java、.Net)、REST接口编程实现。

## 3 S3功能简述 ##

(1)创建桶、删除桶

(2)写入、读取、删除数据元，每个数据元的大小从1byte到5Tbyte

(3)根据用户密钥，查询桶信息及数据元信息

(4)选择数据所存储的地区，东京 or 新加坡 or 其他

(5)数据元的权限设置，可以向指定的用户开放，加密等

(6)使用基于REST和SOAP接口，提供JAVA，net的SDK

(7)便于添加其他功能，默认的下载协议是HTTP

(8)提供AWS管理平台，对数据进行管理

(9)在进行存储或者检索数据时，对数据进行校验和计算，验证是否损坏

(10)去冗余存储，用户可以自定义一些文件，比如缩略图、转码媒体等，使得这些文件的存储冗余副本数目低于标准的冗余副本数目

(11)数据源的访问日志记录，可用于审核等

(12)对数据元提供版本控制功能，用户可以恢复到之前的版本

## 4 访问控制机制 ##

S3的访问控制机制，主要有四种。

(1) Identity and Access Management (IAM) 策略：

IAM让拥有多名员工的组织能够在一个AWS账户下创建和管理多个用户，通过IAM策略，可以授予指定的用户对桶和数据元的细化控制。

(2)访问控制列表(ACL)：

选择性的授予对个别数据元或者桶的特定权限。

(3)桶策略：

桶策略可以添加或者拒绝对单一桶内的部分或者所有数据元的权限。

(4)查询字符串身份验证：

根据此项的验证，能够通过仅在限定时间段内有效的URL共享数据元。

### 4.1 使用IAM策略 ###

IAM策略就是AWS Identity and Access Management。使用此策略可以利用AWS账户创建多个用户，给这些用户分配证书、管理其权限。主要是针对用户的。类似的还有ACL和桶策略。下面是三者的对比表：

![04215148-cefc92c4f47549c88da03fcf9a5b4707.jpg][]

通过ACL，可以赋予其他的AWS账户相关权限来访问本账户所拥有的资源，通过IAM，只能赋予本AWS账户下创建的用户相关的访问权限。控制级别不一样。三者之间可以相互搭配，来组合安全策略。三者之间，在某些条件下也是等价的，比如：

![04215201-92bb07469ebd4efab9862429fb92fac2.jpg][]

在策略中，需要对objec 进行相关的action操作，就像上图中的PutObject一样，action列表如下。

Actions Related to Objects

*  `s3:GetObject` (covers REST GET Object, REST HEAD Object, REST GET Object torrent, SOAP `GetObject`, and SOAP `GetObjectExtended`)
 *  `s3:GetObjectVersion` (covers REST GET Object, REST HEAD Object, REST GET Object torrent, SOAP `GetObject`, and SOAP `GetObjectExtended`)
 *  `s3:PutObject` (covers the REST PUT Object, REST POST Object, REST Initiate Multipart Upload, REST Upload Part, REST Complete Multipart Upload, SOAP `PutObject`, and SOAP `PutObjectInline`)
 *  `s3:GetObjectAcl`
 *  `s3:GetObjectVersionAcl`
 *  `s3:PutObjectAcl`
 *  `s3:PutObjectVersionAcl`
 *  `s3:DeleteObject`
 *  `s3:DeleteObjectVersion`
 *  `s3:ListMultipartUploadParts`
 *  `s3:AbortMultipartUpload`
 *  `s3:GetObjectTorrent`
 *  `s3:GetObjectVersionTorrent`
 *  `s3:RestoreObject`

Actions Related to Buckets

*  s3:CreateBucket
 *  s3:DeleteBucket
 *  s3:ListBucket
 *  s3:ListBucketVersions
 *  s3:ListAllMyBuckets (covers REST GET Service and SOAP ListAllMyBuckets)
 *  s3:ListBucketMultipartUploads

Actions Related to Bucket Sub-Resources

*  s3:GetBucketAcl
 *  s3:PutBucketAcl
 *  s3:GetBucketCORS
 *  s3:PutBucketCORS
 *  s3:GetBucketVersioning
 *  s3:PutBucketVersioning
 *  s3:GetBucketRequestPayment
 *  s3:PutBucketRequestPayment
 *  s3:GetBucketLocation
 *  s3:GetBucketPolicy
 *  s3:DeleteBucketPolicy
 *  s3:PutBucketPolicy
 *  s3:GetBucketNotification
 *  s3:PutBucketNotification
 *  s3:GetBucketLogging
 *  s3:PutBucketLogging
 *  s3:GetBucketWebsite
 *  s3:PutBucketWebsite
 *  s3:DeleteBucketWebsite
 *  s3:GetLifecycleConfiguration
 *  s3:PutLifecycleConfiguration

同时，还有策略的Key值，可以根据策略的key来更加严格的控制资源。key值列表如下：

<table style="margin:0px; padding:0px; border-collapse:collapse; border-spacing:0px; border:1px solid rgb(192,192,192)"> 
 <thead style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <th style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse"> Action</th> 
 <th style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse"> Applicable Keys</th> 
 <th style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse"> Description</th> 
 </tr> 
 </thead> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:PutObject</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-acl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The Amazon S3 canned ACL that is applied to the object. A canned ACL represents a predefined permission that can be applied to the object being PUT to Amazon S3. Valid values:&nbsp;<code style="margin:0px; padding:0px">private</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read-write</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">authenticated-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">bucket-owner-read</code>&nbsp;|<code style="margin:0px; padding:0px">bucket-owner-full-control</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">log-delivery-write</code>. Example value:&nbsp;<code style="margin:0px; padding:0px">public-read</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-copy-source</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The header that specifies the name of the source bucket and key name of the source object, separated by a slash (/). Used when copying an object. Example value:&nbsp;<code style="margin:0px; padding:0px">/bucketname/keyname</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-grant-read, s3:x-amz-grant-write, s3:x-amz-grant-read-acp, s3:x-amz-grant-write-acp, s3:x-amz-grant-full-control</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to&nbsp;<a href="http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">PUT Object</a>. For an example policy that uses these condition keys, see&nbsp;<a title="Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control" href="http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html#AccessPolicyLanguage_UseCase8_s3" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control&nbsp;</a>. </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-server-side-encryption</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> Allow the specific action only if&nbsp;<code style="margin:0px; padding:0px">x-amz-server-side-encryption</code>&nbsp;header is present in the request and its value matches the specified condition. with Valid values: AES256 Example value:&nbsp;<code style="margin:0px; padding:0px">AES256</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-metadata-directive</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The header that specifies whether the metadata is copied from the source object or replaced with metadata provided in the request. If copied, the metadata, except for the version ID, remains unchanged. Otherwise, all original metadata is replaced by the metadata you specify. Used when copying an object. Valid values:&nbsp;<code style="margin:0px; padding:0px">COPY</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">REPLACE</code>. The default is&nbsp;<code style="margin:0px; padding:0px">COPY</code>. Example value:&nbsp;<code style="margin:0px; padding:0px">REPLACE</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:PutObjectAcl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-acl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The Amazon S3 canned ACL that is applied to the object. A canned ACL represents a predefined permission that can be applied to the object being PUT to Amazon S3. Valid values:&nbsp;<code style="margin:0px; padding:0px">private</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read-write</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">authenticated-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">bucket-owner-read</code>&nbsp;|<code style="margin:0px; padding:0px">bucket-owner-full-control</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">log-delivery-write</code>. Example value:&nbsp;<code style="margin:0px; padding:0px">public-read</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-grant-read, s3:x-amz-grant-write, s3:x-amz-grant-read-acp, s3:x-amz-grant-write-acp, s3:x-amz-grant-full-control</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to&nbsp;<a href="http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUTacl.html" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">PUT Object acl</a>. For an example policy that uses these condition keys, see&nbsp;<a title="Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control" href="http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html#AccessPolicyLanguage_UseCase8_s3" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control&nbsp;</a>. </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:GetObjectVersion</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:VersionId</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The version ID of the object being retrieved. Example value:&nbsp;<code style="margin:0px; padding:0px">Upfdndhfd8438MNFDN93jdnJFkdmqnh893</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:GetObjectVersionAcl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:VersionId</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The version ID of the object ACL being retrieved. Example value:&nbsp;<code style="margin:0px; padding:0px">Upfdndhfd8438MNFDN93jdnJFkdmqnh893</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:PutObjectVersionAcl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:VersionId</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The version ID of the object ACL being PUT. Example value:&nbsp;<code style="margin:0px; padding:0px">Upfdndhfd8438MNFDN93jdnJFkdmqnh893</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-acl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The Amazon S3 canned ACL that is applied to the object. A canned ACL represents a predefined permission that can be applied to the object being PUT to Amazon S3. Valid values:&nbsp;<code style="margin:0px; padding:0px">private</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read-write</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">authenticated-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">bucket-owner-read</code>&nbsp;|<code style="margin:0px; padding:0px">bucket-owner-full-control</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">log-delivery-write</code>. Example value:&nbsp;<code style="margin:0px; padding:0px">public-read</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-grant-read, s3:x-amz-grant-write, s3:x-amz-grant-read-acp, s3:x-amz-grant-write-acp, s3:x-amz-grant-full-control</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to&nbsp;<a href="http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUTacl.html" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">PUT Object acl</a>. For an example policy that uses these condition keys, see&nbsp;<a title="Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control" href="http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html#AccessPolicyLanguage_UseCase8_s3" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control&nbsp;</a>. </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:DeleteObjectVersion</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:VersionId</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The version ID of the object being deleted. Example value:&nbsp;<code style="margin:0px; padding:0px">Upfdndhfd8438MNFDN93jdnJFkdmqnh893</code> </td> 
 </tr> 
 </tbody> 
</table>

桶策略：

<table style="margin:0px; padding:0px; border-collapse:collapse; border-spacing:0px; border:1px solid rgb(192,192,192)"> 
 <thead style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <th style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse"> Action</th> 
 <th style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse"> Applicable Keys</th> 
 <th style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse"> Description</th> 
 </tr> 
 </thead> 
 <tbody style="margin:0px; padding:0px"> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:CreateBucket</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-acl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The Amazon S3 canned ACL that is applied to the bucket. A canned ACL represents a predefined permission that can be applied to the bucket being created. Valid values:&nbsp;<code style="margin:0px; padding:0px">private</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read-write</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">authenticated-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">bucket-owner-read</code>&nbsp;|<code style="margin:0px; padding:0px">bucket-owner-full-control</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">log-delivery-write</code>. Example value:&nbsp;<code style="margin:0px; padding:0px">public-read</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:LocationConstraint</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> Specifies the Region where the bucket will be created. Valid values are&nbsp;<code style="margin:0px; padding:0px">us-west-1</code>&nbsp;(for Northern California) or&nbsp;<code style="margin:0px; padding:0px">EU</code>&nbsp;(for Ireland). Do not specify a value for US Standard. Example value:&nbsp;<code style="margin:0px; padding:0px">us-west-1</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-grant-read, s3:x-amz-grant-write, s3:x-amz-grant-read-acp, s3:x-amz-grant-write-acp, s3:x-amz-grant-full-control</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to&nbsp;<a href="http://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUT.html" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">PUT Bucket</a>. For an example policy that uses these condition keys, see&nbsp;<a title="Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control" href="http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html#AccessPolicyLanguage_UseCase8_s3" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control&nbsp;</a>. </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:ListBucket</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:prefix</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> Limits the response to objects that begin with the specified prefix. Use this to allow or deny access to objects that begin with the prefix. Example value:&nbsp;<code style="margin:0px; padding:0px">home</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:delimiter</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The character you use to group objects. Example value:&nbsp;<code style="margin:0px; padding:0px">/</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:max-keys</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The number of objects to return from the call. The maximum allowed value (and default) is 1000. For use with access policy language numeric conditions (for more information, see&nbsp;<a title="Numeric Conditions" href="http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Numeric" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">Numeric Conditions</a>). Example value:&nbsp;<code style="margin:0px; padding:0px">100</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:ListBucketVersions</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:prefix</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> Header that lets you limit the response to include only keys that begin with the specified prefix. Example value:&nbsp;<code style="margin:0px; padding:0px">home</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:delimiter</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The character you use to group objects. Example value:&nbsp;<code style="margin:0px; padding:0px">/</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:max-keys</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The number of objects to return from the call. The maximum allowed value (and default) is 1000. For use with access policy language numeric conditions (for more information, see&nbsp;<a title="Numeric Conditions" href="http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Numeric" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">Numeric Conditions</a>). Example value:&nbsp;<code style="margin:0px; padding:0px">100</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:PutBucketAcl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-acl</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> The Amazon S3 canned ACL that is applied to the bucket. A canned ACL represents a predefined permission that can be applied to the bucket being created. Valid values:&nbsp;<code style="margin:0px; padding:0px">private</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">public-read-write</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">authenticated-read</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">bucket-owner-read</code>&nbsp;|<code style="margin:0px; padding:0px">bucket-owner-full-control</code>&nbsp;|&nbsp;<code style="margin:0px; padding:0px">log-delivery-write</code>. Example value:&nbsp;<code style="margin:0px; padding:0px">public-read</code> </td> 
 </tr> 
 <tr style="margin:0px; padding:0px"> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> <code style="margin:0px; padding:0px">s3:x-amz-grant-read, s3:x-amz-grant-write, s3:x-amz-grant-read-acp, s3:x-amz-grant-write-acp, s3:x-amz-grant-full-control</code> </td> 
 <td style="margin:0px; padding:3px; border:1px solid rgb(192,192,192); border-collapse:collapse; word-break:normal!important"> These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to&nbsp;<a href="http://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTacl.html" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">PUT Bucket acl</a>. For an example policy that uses these condition keys, see&nbsp;<a title="Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control" href="http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html#AccessPolicyLanguage_UseCase8_s3" style="margin:0px; padding:0px; color:rgb(100,102,179)" rel="nofollow">Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control&nbsp;</a>. </td> 
 </tr> 
 </tbody> 
</table>

下面是一个利用策略进行权限控制的示例。在例子中，我们插入了一个组叫AllUsers，这包含了所有的从属于同一个AWS账户的IAM用户。现在赋予此组有对my\_corporate\_bucket/readonly文件夹中数据元的GetObject和GetObjectVersion权限。

![复制代码][copycode.gif]

{
    
       "Version":"2012-10-17",
    
       "Statement":[
    
          {
    
             "Effect":"Allow",
    
             "Action":[
    
                "s3:GetObject",
    
                "s3:GetObjectVersion"
    
             ],
    
             "Resource":"arn:aws:s3:::my_corporate_bucket/readonly/*"
    
          }
    
       ]
    
    }

![复制代码][copycode.gif]

### 4.2 桶策略 ###

可以设定桶级别的允许、拒绝的操作权限。

下面是些桶权限相关的例子：

(1)设定桶策略

允许两个用户(1111-2222-3333, 4444-5555-6666)访问执行桶mybucket中对象的GET请求。

![复制代码][copycode.gif]

PUT /?policy HTTP/1.1
    
    Host: bucket.s3.amazonaws.com 
    
    Date: Tue, 04 Apr 2010 20:34:56 GMT 
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:VGhpcyBSAMPLEBieSBlbHZpbmc= 
    
    {
    
    "Version":"2008-10-17",
    
    "Id":"aaaa-bbbb-cccc-dddd",
    
    "Statement" : [
    
        {
    
            "Effect":"Allow",
    
            "Sid":"1",
    
            "Principal" : {
    
                "AWS":["1111-2222-3333","4444-5555-6666"]
    
            },
    
            "Action":["s3:GetObject*"],
    
            "Resource":"arn:aws:s3:::mybucket/*"
    
        }
    
     ]
    
    }

![复制代码][copycode.gif]

(2)获取指定桶的桶策略：

![复制代码][copycode.gif]

GET ?policy HTTP/1.1
    
    Host: mybucket.s3.amazonaws.com
    
    Date: Wed, 28 Oct 2009 22:32:00 GMT
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:VGhpcyBSAMPLEBieSBlbHZpbmc=

![复制代码][copycode.gif]

(3)删除某个桶的桶策略：

![复制代码][copycode.gif]

DELETE /?policy HTTP/1.1
    
    Host: mybucket.s3.amazonaws.com 
    
    Date: Tue, 04 Apr 2010 20:34:56 GMT 
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:VGhpcyBSAMPLEeSBlbHZpbmc=

![复制代码][copycode.gif]

(4)赋予多个AWS账户添加的权限

![复制代码][copycode.gif]

{
    
      "Version":"2008-10-17",
    
      "Statement":[{
    
             "Sid":"AddCannedAcl",
    
            "Effect":"Allow",
    
               "Principal": {
    
                "AWS": ["arn:aws:iam::111122223333:root","arn:aws:iam::444455556666:root"]
    
             },
    
               "Action":["s3:PutObject","s3:PutObjectAcl"
    
          ],
    
          "Resource":["arn:aws:s3:::bucket/*"
    
          ],
    
          "Condition":{
    
            "StringEquals":{
    
              "s3:x-amz-acl":["public-read"]
    
            }
    
          }
    
        }
    
      ]
    
    }

![复制代码][copycode.gif]

(5)限定访问IP

![复制代码][copycode.gif]

{
    
        "Version": "2008-10-17",
    
        "Id": "S3PolicyId1",
    
        "Statement": [
    
            {
    
                "Sid": "IPAllow",
    
                "Effect": "Allow",
    
                "Principal": {
    
                    "AWS": "*"
    
                },
    
                "Action": "s3:*",
    
                "Resource": "arn:aws:s3:::bucket/*",
    
                "Condition" : {
    
                    "IpAddress" : {
    
                        "aws:SourceIp": "192.168.143.0/24"
    
                    },
    
                    "NotIpAddress" : {
    
                        "aws:SourceIp": "192.168.143.188/32"
    
                    }
    
                }
    
            }
    
        ]
    
    }

![复制代码][copycode.gif]

更多例子：

[http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage\_UseCases\_s3\_a.html][http_docs.aws.amazon.com_AmazonS3_latest_dev_AccessPolicyLanguage_UseCases_s3_a.html]

### 4.3 访问控制列表ACL ###

每个桶和数据元对象都有一个ACL。当一个请求发过来的时候，S3会检查ACL列表来确定当前请求是否具有相应的权限。当桶或者数据元对象创建的时候，S3会生成一个默认的ACL，会赋予资源所有者对资源的所有操作权限。

![复制代码][copycode.gif]

<?xml version="1.0" encoding="UTF-8"?>
 
 <AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
 
 <Owner>
 
 <ID>*** Owner-Canonical-User-ID ***</ID>
 
 <DisplayName>owner-display-name</DisplayName>
 
 </Owner>
 
 <AccessControlList>
 
 <Grant>
 
 <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 
 xsi:type="Canonical User">
 
 <ID>*** Owner-Canonical-User-ID ***</ID>
 
 <DisplayName>display-name</DisplayName>
 
 </Grantee>
 
 <Permission>FULL_CONTROL</Permission>
 
 </Grant>
 
 </AccessControlList>
 
 </AccessControlPolicy>

![复制代码][copycode.gif]

每个ACL最多含有100个Grant。其中，Grant元素标识了相关的权限说明。上面有两个重要的元素，是Grantee和Permission。

#### 4.3.1 Grantee ####

每个Grantee可以是AWS账户或者是限定的S3用户组。通过email地址或者标准的用户ID来给指定的AWS账户赋权。S3会把相应的账户ID放入ACL中。如果是赋予group的话，目前S3提供了三种group。

(1)Authenticated User group:例如 [http://acs.amazonaws.com/groups/global/AuthenticatedUsers][http_acs.amazonaws.com_groups_global_AuthenticatedUsers]。代表了所有的AWS账户，对这个组进行权限控制的话，会对所有的账户起作用。

(2)All User group：例如[http://acs.amazonaws.com/groups/global/AllUsers][http_acs.amazonaws.com_groups_global_AllUsers]。对这个组进行权限控制的话，所有的AWS注册账户或者匿名账户都会起作用。

(3)Log Delivery group：例如[http://acs.amazonaws.com/groups/s3/LogDelivery][http_acs.amazonaws.com_groups_s3_LogDelivery]。桶的写权限使得此组可以对这个桶写服务端的访问日志。

#### 4.3.2 Permissions ####

下面是一张权限的列表：

![04215901-49f62a3bfa39420d8b8c416ee81b7651.jpg][]

同时，S3还提供了一些默认的grant，这就是canned ACL。

![04215916-7856a3bf407b4781846ce6249b02b709.jpg][]

#### 4.3.3 其他 ####

ACL提供了粗粒度的权限模型，桶策略提供了更加细腻的权限控制模型。二者可以单独使用，也可以混合使用。

Actions和Permissions也有区别。策略可以允许或者拒绝actions，ACLS可以赋予相应的permissions。actions是permissions的一方面。

Object ACL Permissions

*  READ—Granting READ permission in an object ACL allows the s3:GetObject, s3:GetObjectVersion, and s3:GetObjectTorrent actions to be performed on that object.
 *  READ\_ACP—Granting READ\_ACP permission in an object ACL allows the s3:GetObjectAcl and s3:GetObjectVersionAcl actions to be performed on that object.
 *  WRITE\_ACP—Granting WRITE\_ACP permission in an object ACL allows the s3:PutObjectAcl and s3:PutObjectVersionAcl actions to be performed on that object.
 *  FULL\_CONTROL—Granting FULL\_CONTROL permission in an object ACL is equivalent to granting READ, READ\_ACP, and WRITE\_ACP permission.

Bucket ACL Permissions

*  READ—Granting READ permission in a bucket ACL allows the s3:ListBucket, s3:ListBucketVersions, and s3:ListBucketMultipartUploads actions to be performed on that bucket.
 *  WRITE—Granting WRITE permission in a bucket ACL allows the s3:PutObject and s3:DeleteObject actions to be performed on any object in that bucket. In addition, when the grantee is the bucket owner, granting WRITE permission in a bucket ACL allows the s3:DeleteObjectVersion action to be performed on any version in that bucket.
 *  READ\_ACP—Granting READ\_ACP permission in a bucket ACL allows the s3:GetBucketAcl action to be performed on that bucket.
 *  WRITE\_ACP—Granting WRITE\_ACP permission in a bucket ACL allows the s3:PutBucketAcl action to be performed on that bucket.
 *  FULL\_CONTROL—Granting FULL\_CONTROL permission in a bucket ACL is equivalent to granting READ, WRITE, READ\_ACP, and WRITE\_ACP permission.

## 5 发起请求 ##

发起请求可以有两种方式，一种是通过提供的SDK接口，另一种是通过REST接口。

### 5.1 请求的包头 ###

`(1)AWS Access Key Id``：访问的Key`

`(2)``签名：每个请求都必须包含一个有效的请求签名`

`(3)``时间戳：请求发起的时间戳,date和time`

`另外，还可以提供一个请求失效的时间戳。`

### `5.2 ``请求步骤` ###

`发起一个验证请求的步骤如下(请求只能是GET形式)：`

`(1)``创建一个request，其内容包含：`

![04220039-39263f7fc5dd4e128754783e345b43d6.jpg][]

`类似于：`

GET /photos/puppy.jpg HTTP/1.1

Host: johnsmith.s3.amazonaws.com

Date: Mon, 26 Mar 2007 19:37:58 +0000

Authorization: AWS AKIAIOSFODNN7EXAMPLE:frJIUN8DYpKDtOLCwo//yllqDzg=

(2)创建一个签名：

![04220215-ebd49b8b2f534925958f29d3439c31b9.jpg][]

签名的计算格式如下：

![复制代码][copycode.gif]

Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature;
 
 Signature = Base64( HMAC-SHA1( YourSecretAccessKeyID, UTF-8-Encoding-Of( StringToSign ) ) );
 
 StringToSign = HTTP-Verb + "\n" +
 Content-MD5 + "\n" +
 Content-Type + "\n" +
 Date + "\n" +
 CanonicalizedAmzHeaders +
 CanonicalizedResource;
 
 CanonicalizedResource = [ "/" + Bucket ] +
 <HTTP-Request-URI, from the protocol name up to the query string> +
 [ sub-resource, if present. For example "?acl", "?location", "?logging", or "?torrent"];
 
 CanonicalizedAmzHeaders = <described below>

![复制代码][copycode.gif]

(3)发送请求和签名到AWS：

![04220336-c8c6809af27a407bbbe6bdc8f788d29a.jpg][]

(4)AWS获取用户的access key

![04220345-bf9c5067e9e345428339508cba487c52.jpg][]

(5)AWS重新计算签名：

![04220353-97a61f6dccb947719c630c222a007bef.jpg][]

(6)把AWS计算的签名值和用户传来的签名值进行对比，返回验证结果：

![04220409-ba07100888054a1696f90d76cf4c2988.jpg][]

### 5. 3 桶的虚拟host ###

可以通过url访问指定的桶信息：[http://bucketname.s3.amazonaws.com][http_bucketname.s3.amazonaws.com]。或者可以通过在指定的域名后面追加桶的名字：[http://my.bucketname.com/][http_my.bucketname.com]。

## 6 桶 ##

一些条件限制：

(1)桶和桶是不能嵌套的

(2)每个AWS同时最多创建100个桶

(3)桶的名字是可重用的，前提是同一个名字对应的其他桶已经被删除掉

(4)桶中的容量是无限制的，可以存储任意多个对象

(5)桶名字的命名长度是3到63个字符，可包含字母、数字、斜杠、点号

(6)名字的开始和结束必须是小写字母或者是数字，不能有两个及以上连续的符号在一起

## 7 数据元 ##

### 7.1 结构 ###

每个数据元都包含以下几个部分：

(1)key：用于检索数据元的唯一标识。utf8编码，最多1024字节长度

(2)Version ID：key和version作为唯一识别一个数据元对象的标志，当添加数据元对象到S3的时候自动产生。每个数据元对象可以保留多个版本，默认不开启版本管理，即只有一个版本。

(3)value：所存储的具体数据，大小为0到5T字节。可以一次性的上传5T的文件，也可以将大文件拆分成一个个的小部分，每个部分独立的上传。

(4)metadata：就是一系列的键值对，在上传数据元对象的时候可以指定这个metadata，但是上传完之后，就不能更改了。唯一可以修改的做法是在复制数据元的时候。metadata分为两种，一种是系统metadata，另一种是用户自定义的metadata。

系统metadata：

![04220449-c904613750a34297926115dc2737edfd.jpg][]

用户metadata：

如果是以rest接口实现的话，开头必须是“x-amz-meta-”

每个数据元对象都和一个storage class相关联，可以在使用使用 `x-amz-storage-class``关键字指定存储类型，例如：`

![复制代码][copycode.gif]

PUT /my-image.jpg HTTP/1.1
    
    Host: myBucket.s3.amazonaws.com
    
    Date: Wed, 12 Oct 2009 17:50:00 GMT
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:xQE0diMbLRepdf3YB+FIEXAMPLE=
    
    Content-Type: image/jpeg
    
    Content-Length: 11434
    
    Expect: 100-continue
    
    x-amz-storage-class: REDUCED_REDUNDANCY
    
    storage class有如下几种：
    
    Standard：provides 99.999999999% durability and 99.99% availability
    
    Reduced Redundancy Storage：provides 99.99% durability and 99.99% availability 
    
    Glacier：suitable for archiving data

![复制代码][copycode.gif]

另外可以更改storage class的类型，通过结合`x-amz-metadata-directive` 标签和`x-amz-storage-class``，例如：`

`将storage class更改为RSS：`

![复制代码][copycode.gif]

PUT /my-image.jpg HTTP/1.1
    
    Host: bucket.s3.amazonaws.com
    
    Date: Wed, 28 Oct 2009 22:32:00 GMT
    
    x-amz-copy-source: /bucket/my-image.jpg
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:0RQf4/cRonhpaBX5sCYVf1bNRuU=
    
    x-amz-storage-class: REDUCED_REDUNDANCY
    
    x-amz-metadata-directive: COPY

![复制代码][copycode.gif]

将storage class更改为标准存储：

![复制代码][copycode.gif]

(5)subresource：用于存储对象的额外信息。

acl：包含授权信息列表，当创建数据元的时候，acl会定义数据元的访问权限，可以更改这个acl。

torrent：支持BitTorrent协议。使用torrent，可以返回和数据元对象相关联的torrent文件。可以在GET请求中指定torrent文件。可以查询，但是不能修改、删除、添加torrent文件。

(6)access control information：访问控制信息

### 7.2 数据元的生命周期管理 ###

可以对指定的数据元对象定义管理规则，每个rule必须包含如下内容：

(1)数据元的key前缀，即rule的应用对象，可能是某一类的数据元

(2)action，对应到这些指定object对象的操作

(3)时间点或者周期长度，可以定时的执行上述的action事件

如下是个生命周期管理的示例配置：

![复制代码][copycode.gif]

<LifecycleConfiguration>
 <Rule>
 <ID>Example Rule</ID>
 <Prefix>projectdocs/</Prefix>
 <Status>Enabled</Status>
 <Transition>
 <Days>365</Days>
 <StorageClass>GLACIER</StorageClass>
 </Transition>
 <Expiration>
 <Days>3650</Days>
 </Expiration>
 </Rule>
 </LifecycleConfiguration>

![复制代码][copycode.gif]

每个Lifecycle最多包含1000条rule。如果有版本的话，对应的数据元对象是不能进行生命周期管理设置的。

在rule中可以对数据元进行归档和删除操作，分别需要注意如下。

对数据元进行归档处理之前应注意：

(1)处于Glacier storage classs中的数据元对象不是实时存在的，归档之前必须要存储个临时备份，此备份只在请求中指定的时间段存在。之后系统会删除掉此备份；

(2)同样，在转变storage class的时候，也必须有个备份

(3)如果在规则定义的时候，指定的前缀为空，则是面向所有的数据元对象

删除数据元对象的时候应注意：

(1)删除要慎重，删除完，数据是不可恢复的

(2)指定的前缀为空，则是删除所有的数据元对象

### 7.3 关于数据元的共享 ###

主要针对web应用，当web应用是在一个域中被加载，需要和其他域中的资源进行交互，这就需要用到数据的共享。可以选择性的把自己在S3中的资源进行共享来构建web rich客户端。

共享可以在配置文件中进行配置实现。

![复制代码][copycode.gif]

<CORSConfiguration>
 <CORSRule>
 <AllowedOrigin>http://www.example.com</AllowedOrigin>
 <AllowedMethod>PUT</AllowedMethod>
 <AllowedMethod>POST</AllowedMethod>
 <AllowedMethod>DELETE</AllowedMethod>
 
 <AllowedHeader>*</AllowedHeader>
 </CORSRule>
 <CORSRule>
 <AllowedOrigin>*</AllowedOrigin>
 <AllowedMethod>GET</AllowedMethod>
 </CORSRule>
 </CORSConfiguration>

![复制代码][copycode.gif]

上例是桶中的配置遵循两条规则。第一条是限制只能从指定的域中指定的方法来访问资源。第二条是允许从所有的域中只能有GET方式获取资源。

![复制代码][copycode.gif]

<CORSConfiguration>
 <CORSRule>
 <AllowedOrigin>http://www.example.com</AllowedOrigin>
 <AllowedMethod>PUT</AllowedMethod>
 <AllowedMethod>POST</AllowedMethod>
 <AllowedMethod>DELETE</AllowedMethod>
 <AllowedHeader>*</AllowedHeader>
 <MaxAgeSeconds>3000</MaxAgeSeconds>
 <ExposeHeader>x-amz-server-side-encryption</ExposeHeader>
 <ExposeHeader>x-amz-request-id</ExposeHeader>
 <ExposeHeader>x-amz-id-2</ExposeHeader>
 </CORSRule>
 </CORSConfiguration>

![复制代码][copycode.gif]

上例中指定了资源的缓存时间MaxAgeSeconds，以及http响应头。

定义的规则中可以动态的包含如下元素：

(1)AllowedMethod：GET,PUT,POST,DELETE,HEAD

(2)AllowedOrign:类似于[http://\*.example.com][http_.example.com]

(3)AllowedHeader:

(4)ExposeHeader:

(5)MaxAgeSeconds:秒级别，缓存响应的时间

关于通用的一些HTTP响应头信息(使用在REST接口中)：

(1)Content-Length:响应的字节长度，字节为单位，类型是String，没有默认值

(2)Connection：指定和服务器的连接是打开还是关闭，类型是Enum，只能是open或者close的一种，没有默认值

(3)Date：响应的时间，类型是String，没有默认值，值类似于Wed, 01 Mar 2009 12:00:00 GMT

(4)ETag：数据元对象的hash值，也可以是md5值

(5)Server：响应的Server的名字，字符串类型，默认值是AmazonS3

(6) x-amz-delete-marker：数据元对象返回是否删除Marker，值只能是true或者false，默认是false

(7)x-amz-id-2:一个指定的token，类型是String，没有默认值

(8)x-amz-request-id:用于区分request的唯一标识，类型是String，没有默认值

(9)x-amz-version-id：数据元对象的version，如果允许有版本存在的话，S3会产生一个随机的数字作为版本号，类型是String，有效值是null或者任何UTF8编码的string，没有默认值。

### 7.4 分段上传操作 ###

当遇到大文件的时候，可以采用Multipart Upload来完成上传操作和复制操作。分三个步骤完成：初始化upload，上传upload部分，完成upload。

(1)Initation Multipart Upload：当客户端请求多部分上传时，S3会返回一个uploadID，在上传分段以及完成上传、退出上传的时候，会用到此ID。

(2)Parts Upload：需要指定分段的编号，编号的范围从1到10000，每上传完一个分段，S3都会返回ETag头作为响应。如果上传的时候，分段的编号一样，后上传的会把之前上传的覆盖掉。

(3)Multipart Up分段load Completion(or Abort):完成上传的时候，S3会通过拼接每个分段来创建一个完整的数据元对象。也可以退出上传，退出之后，当前的UploadID就作废了。

可以并发的进行分段上传。

关于分段上传，有以下需要注意的点：

![04221501-b88eb35ab5c748268a2327a969ffdb0e.jpg][]

## 8 数据保护 ##

S3会周期性的对存储的数据元对象进行校验(MD5结合CRC)，如果发现数据损坏了，则会尝试利用冗余的备份数据进行修复。并且，数据在进行网络传输(读、写)的时候，也需要进行校验和的计算、检验。

S3对数据提供99.999999999%的持久性和99.99%的可靠性。

### 8.1 数据加密 ###

加密可以分为两种，一种是在客户端进行加密，一种是在服务端进行加密。针对第一种情况，客户端加密，用户可以自己管理加密过程，加密的密钥。但是在服务端进行加密的话，操作会更简单。因为密钥等都会由S3来维护，加密完后再进行存储，同样，在读取的时候会首先进行解密。Server端采用的256位的AES加密，加密的只是数据元对象的数据值。

### 8.2 数据的版本 ###

在同一个桶中，用户可以拥有具有相同key的两个数据元对象，但是二者的版本号不同。

![04221512-c4d20db648c6442b82f4c12befc4467e.jpg][]

桶现在有三种状态：unversioned(默认的状态)、versioning-enabled、versioning-suspended。但是一旦开启了version功能，就不能再变为unverisoned状态了，只能把这个状态挂起version-suspend。版本是针对桶级别的，一旦设置了，桶下面所有的存储对象都会受到影响。

开启version可以有两种方式：

(1)Put Bucket的请求中，添加versioning

(2)在请求中，添加Enabled状态

![复制代码][copycode.gif]

PUT /?versioning HTTP/1.1
 
 Host: bucketName.s3.amazonaws.com
 
 Date: Wed, 12 Oct 2009 17:50:00 GMT
 
 Authorization: AWS AKIAIOSFODNN7EXAMPLE:xQE0diMbLRepdf3YB+FIEXAMPLE=
 
 Content-Type: text/plain
 
 Content-Length: 124 
 
 <VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
 
 <Status>Enabled</Status>
 
 </VersioningConfiguration>

![复制代码][copycode.gif]

当把version挂起的时候，已有的数据元对象不会发生什么变化。查询的时候可以指定版本号。如果不指定，会返回最新的一个版本。

![04221603-175c2c0a7ee24138adfabab3697268b6.jpg][]

通过HEAD来查询指定版本的METADATA信息，格式如下：

![复制代码][copycode.gif]

HEAD /my-image.jpg?versionId=3HL4kqCxf3vjVBH40Nrjfkd HTTP/1.1
    
    Host: bucket.s3.amazonaws.com
    
    Date: Wed, 28 Oct 2009 22:32:00 GMT
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:0RQf4/cRonhpaBX5sCYVf1bNRuU=

![复制代码][copycode.gif]

### 8.3 删除 ###

如果要删除已经开启版本的数据对象时，是没有办法立即永久删除的。S3只是针对需要删除的数据对象的最新的版本里插入了一个删除的标志位，当查询的时候，就会给出提示说这个数据对象已经被删除了，并且返回一个404错误页面。

![04221637-03a4f243d09541e9afe0f255a8d5b7c6.jpg][]

如果想要永久性的删除，必须要指定版本号才行。

![04221657-28dc7eccfaf34f0ba89aec13b652fd72.jpg][]

![复制代码][copycode.gif]

DELETE /photo.gif?versionId=UIORUnfnd89493jJFJ HTTP/1.1
    
    Host: bucket.s3.amazonaws.com
    
    Date: Wed, 12 Oct 2009 17:50:00 GMT
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:xQE0diMbLRepdf3YB+FIEXAMPLE=
    
    Content-Type: text/plain
    
    Content-Length: 0

![复制代码][copycode.gif]

如果删除多次，S3会依次给最新的版本上加入删除标记，已有的删除标记不会被删掉：

![04221718-ad59bcb5f5c844a09eba7d2181c13991.jpg][]

另外，可以通过指定版本ID移除删除标记：

![04221727-c7ba9035a04b465eb02bb838cbe7f901.jpg][]

![复制代码][copycode.gif]

DELETE /photo.gif?versionId=4857693 HTTP/1.1
    
    Host: bucket.s3.amazonaws.com
    
    Date: Wed, 28 Oct 2009 22:32:00 GMT
    
    Authorization: AWS AKIAIOSFODNN7EXAMPLE:0RQf4/cRonhpaBX5sCYVf1bNRuU=

![复制代码][copycode.gif]

另外，可以同时一次性删除最多1000个数据元对象。

### 8.4 version-suspended状态的操作 ###

如果当前是版本的挂起状态即version-suspended状态，那么新加入的数据对象的版本就是null：

![04221745-f858f101978948958fc263f498f43ece.jpg][]

如果null的version已经存在，则后添加的会把之前的覆盖掉：

![04221758-4dc785b8c5f14157965b52f5d4a776bd.jpg][]

![04221826-d6d53d01192d4c94bdbb1b377c8168ff.jpg][]

查询的时候，会取最新添加的版本：

![04221841-4227933d945a421e819323a1bb46e9c0.jpg][]

此状态下只能移除version为null的版本，同样，也是会加入删除的标志位来进行删除，即使多次删除也是只对version为null的起作用：

![04221901-5b7e407f96db4a56bef1ee3e6c952a7c.jpg][]

如果指定的删除的versionID的话，依然会直接删除：

![04221910-4e3c8303a38346e3a0c916424727f9c7.jpg][]

### 8.5 其他 ###

当拷贝一个数据对象到同一个桶中的时候，被拷贝的数据对象就变成最新的版本，如果开启版本的话。同样，删除一个最新的版本，次新的版本会变成最新的版本。

## 9 存储静态网站 ##

S3支持存储静态网站的一些资源和页面。若已经存储，则存储的静态网站在S3的访问WEB地址如下：

<bucket-name>.s3-website-<AWS-region>.amazonaws.com

数据存储在不同区域的话，域名会有些区别：

当请求不合法的时候，S3会返回一些错误信息页面，下面是具体的错误页面内容及其触发条件：

S3还提供了一种触发事件报警机制，当触发条件满足时，就会以邮件、短信等形式发出报警。目前只支持数据对象丢失的报警。可以在添加数据的时候指定这个出发事件：

![复制代码][copycode.gif]

PUT ?notification HTTP/1.1
 
 Host: quotes.s3.amazonaws.com
 
 Date: Wed, 02 June 2010 12:00:00 GMT
 
 Authorization: AWS AKIAIOSFODNN7EXAMPLE:xQE0diMbLRepdf3YB+FIEXAMPLE=
 
 <NotificationConfiguration>
 
 <TopicConfiguration>
 
 <Topic>arn:aws:sns:us-east-1:111122223333:myTopic</Topic>
 
 <Event>s3:ReducedRedundancyLostObject</Event>
 
 </TopicConfiguration>
 
 </NotificationConfiguration>

![复制代码][copycode.gif]

报警的内容包括如下几个部分：

下面就是报警的一个实例：

![复制代码][copycode.gif]

{
    
        "Service":"Amazon S3",
    
        "Event": "s3:ReducedRedundancyLostObject",
    
        "Time":"2010-02-11T23:48:22.000Z",
    
        "Bucket": "myphotos",
    
        "Key": "Home/2009/10/carvingpumpkins.jpg",
    
        "VersionId":"qfXHy5689N7n9mWVwanN_hIroMn_rzXl",
    
        "RequestId":"4442587FB7D0A2F9",
    
        "HostId":"fHZOHz+oQlKAFQ7RgVSklvcDNYI0v05gsOWWeJcyTTXWgGzI6CC5FZVICjD9bUzT"
    
    }

![复制代码][copycode.gif]

## 10 支持BitTorrent ##

可以使用BitTorrent协议来下载数据对象。

[Amazon S3]: http://www.cnblogs.com/Scott007/archive/2013/06/04/3118000.html
[04215148-cefc92c4f47549c88da03fcf9a5b4707.jpg]: /images/20211109/146d0561b1f3436fb7086b1feee0d35c.png
[04215201-92bb07469ebd4efab9862429fb92fac2.jpg]: /images/20211109/34efab3daced4fdba87008a142a03d74.png
[copycode.gif]: /images/20211109/18d6e6a5c1cd403cb006f3ee94e448d5.png
[http_docs.aws.amazon.com_AmazonS3_latest_dev_AccessPolicyLanguage_UseCases_s3_a.html]: http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html
[http_acs.amazonaws.com_groups_global_AuthenticatedUsers]: http://acs.amazonaws.com/groups/global/AuthenticatedUsers
[http_acs.amazonaws.com_groups_global_AllUsers]: http://acs.amazonaws.com/groups/global/AllUsers
[http_acs.amazonaws.com_groups_s3_LogDelivery]: http://acs.amazonaws.com/groups/s3/LogDelivery
[04215901-49f62a3bfa39420d8b8c416ee81b7651.jpg]: /images/20211109/b77ceef45da840968bc65732613c8626.png
[04215916-7856a3bf407b4781846ce6249b02b709.jpg]: /images/20211109/0c6ab27acae642a2bbd49b1773ccb6f3.png
[04220039-39263f7fc5dd4e128754783e345b43d6.jpg]: /images/20211109/5d911ed7e0724cf58761ee799a119b0b.png
[04220215-ebd49b8b2f534925958f29d3439c31b9.jpg]: /images/20211109/5cbb2c201887426d823156ea5d0fbb0a.png
[04220336-c8c6809af27a407bbbe6bdc8f788d29a.jpg]: /images/20211109/1ee850ea295043738c9f12aafc440156.png
[04220345-bf9c5067e9e345428339508cba487c52.jpg]: /images/20211109/e316dd3653a94c45b2915e3eab4c56d8.png
[04220353-97a61f6dccb947719c630c222a007bef.jpg]: /images/20211109/1dacf3b0b14d48c3b35a875e3920144a.png
[04220409-ba07100888054a1696f90d76cf4c2988.jpg]: /images/20211109/0bfcb2559e0b492f81f1468ecc7da441.png
[http_bucketname.s3.amazonaws.com]: http://bucketname.s3.amazonaws.com/
[http_my.bucketname.com]: http://my.bucketname.com/
[04220449-c904613750a34297926115dc2737edfd.jpg]: /images/20211109/ec64d914ebf549a48915eb927c7fc203.png
[http_.example.com]: http://%2A.example.com/
[04221501-b88eb35ab5c748268a2327a969ffdb0e.jpg]: /images/20211109/f52aec93ce63407b84282ab6ae8775c8.png
[04221512-c4d20db648c6442b82f4c12befc4467e.jpg]: /images/20211109/f795ab4bdaee4274904abe80478991b0.png
[04221603-175c2c0a7ee24138adfabab3697268b6.jpg]: /images/20211109/55bb45c814f540ba9989273406de07af.png
[04221637-03a4f243d09541e9afe0f255a8d5b7c6.jpg]: /images/20211109/80eebb26e181470b8e190e67ae758ec5.png
[04221657-28dc7eccfaf34f0ba89aec13b652fd72.jpg]: /images/20211109/0264255ab285471e90ebac180c0780af.png
[04221718-ad59bcb5f5c844a09eba7d2181c13991.jpg]: /images/20211109/7bfddf9561924824ac644f865b2006bc.png
[04221727-c7ba9035a04b465eb02bb838cbe7f901.jpg]: /images/20211109/7605a3af402b45d999024e37bec3f90e.png
[04221745-f858f101978948958fc263f498f43ece.jpg]: /images/20211109/4ac9bb3ae0534e4fbe7f44f566a78b58.png
[04221758-4dc785b8c5f14157965b52f5d4a776bd.jpg]: /images/20211109/2b3c28cb1d954333bb694dc2ca813bf1.png
[04221826-d6d53d01192d4c94bdbb1b377c8168ff.jpg]: /images/20211109/78ff0167362c470c9619a3e690670569.png
[04221841-4227933d945a421e819323a1bb46e9c0.jpg]: /images/20211109/3467a833b23846d8bd2d11e19354b2e2.png
[04221901-5b7e407f96db4a56bef1ee3e6c952a7c.jpg]: /images/20211109/d67043c43aa643d39c1a8927f44fe249.png
[04221910-4e3c8303a38346e3a0c916424727f9c7.jpg]: /images/20211109/cbca0fd980e94198bea50aee49c5704b.png