S3 Object Versioning & MFA Delete

Ref: https://learn.cantrill.io/courses/1820301/lectures/41301473

DEMO: https://learn.cantrill.io/courses/1820301/lectures/41301474

S3 Object Versioning

🔧 S3 can store multiple versions of an object with the same key
- Feature enabled on a per-bucket basis
- Different versions of same object have different version IDs (id)
  - S3 operations can specify id to interact with a specific version directly
  - If an S3 operation does not specify id, it defaults to the current/latest version
❗ Storage space is consumed by ALL versions of an object! → Increases costs
- Storing 5 versions of the same object counts the same as storing 5 different objects of the same size
S3 Object Versioning can be in 3 different states: Disabled, Enabled, or Suspended
- While disabled, objects in that bucket have id=null
- ‼️ Once enabled, can never be disabled again!! Only suspended!!
‼️ Suspending Object Versioning does NOT remove old versions of objects in the bucket!!
- You're still billed for old versions, even if versioning is suspended!
2 ways to remove old versions in a bucket:
1. Iterate through bucket and perform version delete on all the old versions of every object
2. Download all current versions of all objects, delete bucket, recreate a new bucket (without version control if you wanted to disable it), and reupload contents
- 💡 As you can see, both options are quite annoying and can be costly, but there's no easy way to remove all the old versions of objects in a bucket…

Some S3 operations work differently depending on S3 Object Versioning being disabled, enabled or suspended:

S3 Object Versioning → // S3 Operation ↓	DISABLED	ENABLED	SUSPENDED
Standard GET	Returns object	Returns current/latest version of object	Returns current/latest version of object
Version GET	N/A	Returns specified version of object	Returns specified version of object
Standard PUT (Modify object)	Overwrites existing object with new object	Creates a new version of the object, marks it as current/latest version	Overwrites current/latest version with new object
Standard DELETE	Deletes object	Creates delete marker on object, previous versions still available	Creates delete marker on object, previous versions still available
Version DELETE	N/A	Deletes specified version of object. If it was current/latest version, second newest becomes current version.	Deletes specified version of object. If it was current/latest version, second newest becomes current version

Delete markers:
- “Hide” the object
  - Standard GET does not return anything
  - S3 Management Console hides the object unless you enable seeing different versions
- Deleting a delete marker “restores” the object (previous current version becomes the current version again)
- Diagram

🔧 Per-bucket configuration → if enabled, requires customer to provide MFA in order to:
1. Version DELETE
2. Change S3 Object Versioning state in the bucket
MFA serial number + MFA code passed within API calls