Ravindra BagaleCourses & study guides मराठी Track your progress
Part 7

AWS S3 and RDS MySQL

Object storage with S3 and a managed MySQL database with RDS – the two AWS services behind almost every real web application, and two favourite targets of attackers.

About this part

Real applications rarely keep files and data on the same small server. They use managed services. On AWS, the two most common are Amazon S3 for files and Amazon RDS for databases.

In the S3 chapter you create buckets, upload objects and write bucket policies. You also share files safely with presigned URLs, links that work only for a limited time. In the RDS chapter you create a managed MySQL database, connect to it from EC2, take backups, and keep it private inside your VPC instead of open to the internet.

Why attackers love these services: public S3 buckets and internet-facing databases have caused many well-known data leaks around the world. In nearly every case, the service worked as designed. The configuration was the problem.

Example: suppose a photo app stores user profile pictures in S3. If the bucket is public, anyone who guesses a file name can download it. With Block Public Access turned on and presigned URLs, only the right user sees the right picture.

You will finish this part knowing the safe default settings for both services.

Related services in other clouds. Azure Blob Storage and Google Cloud Storage do the same job as S3. Azure Database for MySQL/PostgreSQL and Google Cloud SQL do the same job as RDS. The safe defaults (private by default, encryption on, least-privilege access) are the same everywhere.

After this part you will be able to

  1. Create S3 buckets that are private by default, and share files with presigned URLs.
  2. Write a simple bucket policy and test it.
  3. Launch RDS MySQL in a private subnet and connect from EC2.
  4. Take and restore a database snapshot.

A real-world picture

Suppose we are a junior cloud engineer at Swiggy (sample data) storing restaurant menu images in S3. Images must load in the app but never be listed by strangers. You keep Block Public Access on and serve images through CloudFront or presigned URLs. Globally, misconfigured public S3 buckets have exposed data at many well-known companies, which is why AWS now blocks public access by default on new buckets. Everyday analogy: a bank locker. You can let someone in for one visit without giving them the key forever.

Part flowLearnBuild ityourselfBreak itin your labFix itExplain it
How each part of this book is meant to be studied.

Beginner questions I get in class

Q. Can I make an S3 bucket public for a website?
You can host static sites from S3, but the recommended way is CloudFront in front with the bucket kept private.

Q. Why not run MySQL on EC2 instead of RDS?
You can, but RDS handles backups, patching and failover for you, which reduces mistakes.

Q. Will this cost money?
Small RDS and S3 usage fits in the free tier for a limited time. Delete resources after practice.

Key terms

  • Bucket: A container for objects in S3.
  • Object key: The full "path" name of a file in a bucket.
  • Block Public Access: An account- or bucket-level switch that stops public sharing.
  • Presigned URL: A time-limited link to one object.
  • RDS: The managed relational database service: MySQL, PostgreSQL and others.
  • Snapshot: A point-in-time backup of a database or disk.

Mini case study

Suppose we are a junior analyst at Tata Consultancy Services, asked to review a new web server on AWS before launch (with the client's written approval). The checklist from this part becomes a short report: what you checked, what you found (for example "port 22 open to 0.0.0.0/0" or "directory listing on"), the evidence (a command and its output), and the fix. Clear, evidence-based reports like this are how defenders work every day.

Chapters in this part