6.3 Storage Versioning, Replication & Immutability

6.3 Storage Versioning, Replication & Immutability

CloudOps Blueprint Focus: Object and file storage resiliency forms the foundation of cloud operational durability. For the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam, you must understand Amazon S3 Versioning mechanics, delete marker operations, MFA Delete enforcement, S3 Object Lock WORM retention modes and Legal Holds, Cross-Region and Same-Region Replication (CRR/SRR) prerequisites, Replication Time Control (RTC), S3 Batch Replication, and Amazon FSx automated backups and Windows Shadow Copies.

Amazon S3 Versioning: Mechanics & Lifecycle Operations

Amazon S3 Versioning protects data against accidental user overwrites, application logic bugs, and malicious modifications by preserving multiple variants of an object within the same bucket. Once enabled on a bucket, versioning cannot be disabled; it can only be suspended.

Versioning States & Delete Marker Mechanics

Every write operation (PutObject, CopyObject) to a version-enabled bucket generates a unique, opaque Version ID (e.g., 3/L4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY). S3 maintains two categories of object versions:

• Current Version: The latest revision of the object retrieved by default GetObject API requests.
• Noncurrent Version: Historical revisions retained in the bucket as newer revisions are written.

Understanding S3 deletion behavior is critical for operational troubleshooting:

1. Soft Delete: A DeleteObject request without a versionId inserts a zero-byte Delete Marker as the Current Version. Subsequent GetObject calls return 404 Not Found, while past versions remain intact.
2. Reversing Deletion: Deleting the Delete Marker by its specific version ID restores the previous version as current.
3. Permanent Deletion: Permanently removing data requires specifying both the key and the exact versionId (DeleteObject(Key, VersionId)).

S3 Lifecycle Rules with Versioning

Retaining unlimited historical versions inflates storage costs. CloudOps engineers deploy S3 Lifecycle Rules configured with version-specific actions:

• NoncurrentVersionTransitions: Shifts noncurrent versions to lower-cost tiers (such as S3 Standard-Infrequent Access after 30 days and S3 Glacier Flexible Retrieval after 90 days).
• NoncurrentVersionExpiration: Permanently purges noncurrent versions after a defined number of days, or retains only a specified count of recent versions using NewerNoncurrentVersions.
• ExpiredObjectDeleteMarker: Automatically cleans up expired delete markers that no longer have underlying historical versions, reducing bucket listing overhead.

---

MFA Delete: Hardware Protection Against Rogue Operations

To guard against compromised credentials or script errors that could permanently purge versioned buckets, AWS provides MFA Delete.

When MFA Delete is activated on a bucket, AWS enforces multi-factor authentication (MFA) verification for two specific operational actions:

1. Changing the versioning state of the bucket (e.g., suspending versioning).
2. Permanently deleting an object version (issuing a DeleteObject specifying a versionId).

MFA Delete carries strict operational constraints: it cannot be enabled or configured via the AWS Management Console; it must be configured using the AWS CLI or REST API. Furthermore, it requires AWS Account Root User credentials accompanied by a valid TOTP code from a physical hardware token or virtual MFA device (--mfa "arn:aws:iam::123456789012:root 123456"). Standard IAM users and assumed roles cannot authorize MFA Delete actions.

---

S3 Object Lock: WORM Compliance & Legal Holds

Amazon S3 Object Lock provides Write-Once-Read-Many (WORM) storage compliance to prevent objects from being deleted or overwritten for a fixed retention period or indefinitely. Object Lock requires that S3 Versioning be enabled at bucket creation time.

Object Lock provides two distinct retention modes alongside legal hold flags:

In Compliance Mode, no user—including the root account—can overwrite, delete, or shorten the retention period of an object version until its retention timer expires.

A Legal Hold operates independently of retention periods. It places an explicit lock flag on an object version that prevents deletion until an authorized user with s3:PutObjectLegalHold explicitly removes it.

---

S3 Replication Architecture: SRR, CRR, RTC & Batch Operations

Amazon S3 supports automated asynchronous replication between buckets:

• Same-Region Replication (SRR): Replicates objects across buckets within the same AWS Region for log aggregation or cross-account data isolation.
• Cross-Region Replication (CRR): Replicates objects across distinct geographical AWS Regions to fulfill disaster recovery and data locality requirements.

Technical Prerequisites for S3 Replication

Establishing CRR or SRR requires three prerequisites:

1. Versioning Enabled: S3 Versioning must be active on both source and destination buckets.
2. IAM Replication Role: An IAM service role granting S3 permissions to read from source (s3:GetObjectVersionForReplication) and write to destination (s3:ReplicateObject).
3. KMS Permissions for Encrypted Objects: Replicating SSE-KMS objects requires enabling KMS replication in the rule and granting the IAM role decryption rights on the source key (kms:Decrypt) and encryption rights on the destination key (kms:GenerateDataKey, kms:Encrypt).

Replication Time Control (RTC) & Batch Replication

• S3 Replication Time Control (RTC): Guarantees 99.9% of new objects replicate within 15 minutes backed by an SLA, publishing CloudWatch metrics (ReplicationLatency, BytesPendingReplication).
• S3 Batch Replication: Replicates pre-existing objects uploaded prior to replication rule creation, or retries failed objects via S3 Batch Operations.

---

Amazon FSx Data Protection: Automated Backups & Shadow Copies

Amazon FSx for Windows File Server provides two complementary recovery mechanisms:

• Automated Daily Backups: File-system-consistent incremental backups stored in Amazon S3, retained for 1 to 90 days, surviving file system deletion.
• Volume Shadow Copies (VSS): Windows-native point-in-time snapshots scheduled via PowerShell, enabling users to restore previous file revisions directly within Windows File Explorer without IT tickets.