On Lantern’s old server, “storage” was one disk that filled up. On AWS you get three different kinds, each shaped for a different job: objects in Amazon S3, block disks in Amazon EBS, and shared files in Amazon EFS. Most of Lantern’s data belongs in the first.
\nS3 stores objects (any bytes, up to 50 TB each) in buckets. An object is addressed by its key, such as posters/2026/street-food-festival.jpg. The slashes look like folders, and the console draws them as folders, but S3 has no directories: the key is one string, and posters/2026/ is a prefix. Bucket names are unique across all of AWS; the bucket itself lives in the Region you choose.
aws s3 mb s3://lantern-posters --region eu-west-1\naws s3 cp ./posters/ s3://lantern-posters/posters/ --recursive\naws s3 ls s3://lantern-posters/posters/2026/New buckets come with three protections switched on: Block Public Access (all four settings on), Object Ownership set to bucket owner enforced (access control lists disabled, so only policies grant access), and default encryption with S3-managed keys. You change access with bucket policies, as you did in section two.
\nLeave Block Public Access on for every bucket that isn’t deliberately public, and set it at the account level too, so a single mistaken bucket can’t become public:
\naws s3control put-public-access-block --account-id 111122223333 \\\n --public-access-block-configuration \\\n BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=trueIn section four Lantern’s website is served to the public without making any bucket public: CloudFront reads the bucket privately on visitors’ behalf.
\nEvery object has a storage class. They are all designed for the same eleven nines (99.999999999%) of durability; they differ in how you pay.
\n| Class | \nBest for | \nThe catch | \n
|---|---|---|
| S3 Standard (default) | \nFrequently read data | \nHighest storage price | \n
| S3 Intelligent-Tiering | \nUnknown or changing access | \nSmall per-object monitoring fee | \n
| S3 Standard-IA | \nRead about monthly, needs millisecond access | \nRetrieval fee, 30-day minimum | \n
| S3 One Zone-IA | \nRe-creatable copies | \nOne AZ only | \n
| S3 Glacier Instant Retrieval | \nRead about quarterly, millisecond access | \nHigher retrieval fee, 90-day minimum | \n
| S3 Glacier Flexible Retrieval | \nArchives, minutes to hours to restore | \nRestore before reading | \n
| S3 Glacier Deep Archive | \nRarely touched, hours to restore | \n180-day minimum | \n
The price model has three parts: per GB stored per month, per request, and, for the infrequent and archive classes, per GB retrieved. A cheaper storage class with frequent reads can cost more than Standard. Small objects are also a trap: the IA classes bill each object as at least 128 KB.
\nFor Lantern: current posters stay in Standard, posters older than a year move to Glacier Instant Retrieval (they still appear on old event pages), and monthly database exports go to Deep Archive.
\nWith versioning on, overwriting or deleting an object keeps the old version. A delete adds a delete marker instead of destroying data, so an accidental aws s3 rm is recoverable. Once enabled, versioning can only be suspended, never fully removed.
aws s3api put-bucket-versioning --bucket lantern-posters \\\n --versioning-configuration Status=EnabledEvery version is billed as a full object, so pair versioning with a lifecycle rule that moves and expires data automatically:
\n{\n \"Rules\": [\n {\n \"ID\": \"age-out-posters\",\n \"Filter\": { \"Prefix\": \"posters/\" },\n \"Status\": \"Enabled\",\n \"Transitions\": [{ \"Days\": 365, \"StorageClass\": \"GLACIER_IR\" }],\n \"NoncurrentVersionExpiration\": { \"NoncurrentDays\": 30 }\n }\n ]\n}aws s3api put-bucket-lifecycle-configuration --bucket lantern-posters \\\n --lifecycle-configuration file://lifecycle.jsonSome software needs a real file system. That is where the other two services come in.
\nAmazon EBS (Elastic Block Store) is a network disk for one EC2 instance, in one Availability Zone. Almost every instance boots from one. gp3 is the general-purpose SSD type to start with. You pay for the provisioned size, not what you fill, so a 500 GB volume holding 20 GB costs the same as a full one. Snapshots back volumes up incrementally to storage that survives the loss of the AZ.
Amazon EFS (Elastic File System) is a managed NFS file system that many instances, across AZs, mount at the same time. It grows and shrinks with your files and bills per gigabyte actually stored, at a higher rate per gigabyte than EBS. Use it when several servers must share one directory tree.
\nFor Lantern, the answer is mostly “neither”: posters live in S3, where Lambda and CloudFront can reach them. The temporary migration server gets one small gp3 volume, and no EFS at all.
Files are settled. Next: the data that changes every second, in a database.
\n","toc":[{"id":"sec-1","text":"Amazon S3: objects in buckets","level":2},{"id":"sec-2","text":"Safe by default, and keep it that way","level":3},{"id":"sec-3","text":"Storage classes: same API, different price shape","level":3},{"id":"sec-4","text":"Versioning: an undo button with a price","level":3},{"id":"sec-5","text":"Disks for servers: EBS and EFS","level":2}],"takeaways":["Amazon S3 stores objects under keys in buckets, and new buckets block public access, disable ACLs and encrypt objects by default.","Storage classes trade storage price against retrieval cost, retrieval speed and minimum storage duration; S3 Standard is the default.","Versioning keeps every version of every object, which protects against overwrites and deletes but bills for each stored version until a lifecycle rule expires it.","Amazon EBS is a block disk for one EC2 instance in one Availability Zone, billed per provisioned gigabyte.","Amazon EFS is a shared file system that many instances across AZs can mount at once, billed per gigabyte actually stored."],"further":[{"title":"Understanding and managing Amazon S3 storage classes","url":"https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html"},{"title":"Blocking public access to your Amazon S3 storage","url":"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"},{"title":"Retaining multiple versions of objects with S3 Versioning","url":"https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html"},{"title":"What is Amazon Elastic File System?","url":"https://docs.aws.amazon.com/efs/latest/ug/whatisefs.html"}],"quiz":[{"q":"Lantern keeps monthly database exports for seven years and expects to restore one perhaps once a year, with a few hours’ wait acceptable. Which storage class fits?
","options":[{"text":"S3 Glacier Deep Archive","why":"Correct. It has the lowest storage price, and its retrieval time of hours is fine for a once-a-year restore."},{"text":"S3 Standard","why":"It works, but you pay the highest storage price for years on data that is almost never read."},{"text":"S3 One Zone-IA","why":"It keeps data in a single Availability Zone, so losing that AZ could lose the only copy of seven years of backups."},{"text":"S3 Express One Zone","why":"It is built for single-digit-millisecond access by latency-sensitive apps, which is the opposite of an archive."}],"answer":0},{"q":"Versioning is on for the posters bucket. An organiser re-uploads the same poster 40 times while tweaking it. What happens to storage costs?
","options":[{"text":"Nothing changes; S3 stores only the latest version.","why":"With versioning on, every overwrite keeps the previous object as a noncurrent version."},{"text":"Lantern pays for all 40 versions until a lifecycle rule or a person deletes the noncurrent ones.","why":"Correct. Each version is a full stored object. A NoncurrentVersionExpiration rule keeps this under control."},{"text":"S3 deduplicates identical uploads, so only changed bytes are billed.","why":"S3 does not deduplicate. Every version is billed at its full size."}],"answer":1},{"q":"Three EC2 instances in different Availability Zones must read and write the same set of uploaded files through a normal file system path. What do you use?
","options":[{"text":"One EBS volume attached to all three instances.","why":"A standard EBS volume attaches to one instance, and it lives in a single AZ, so instances in other AZs cannot use it."},{"text":"An instance store volume on each instance.","why":"Instance store is local to one instance and its data disappears when the instance stops, so nothing is shared."},{"text":"An Amazon EFS file system mounted on all three.","why":"Correct. EFS is a regional, shared NFS file system that instances in several AZs can mount at the same time."}],"answer":2}],"exercise":{"kind":"fill","language":"bash","template":"# 1. Upload the whole local posters folder, including subfolders\naws s3 {{0}} ./posters/ s3://lantern-posters/posters/ --{{1}}\n\n# 2. Keep old versions when posters are overwritten or deleted\naws s3api put-bucket-versioning --bucket lantern-posters \\\n --versioning-configuration Status={{2}}\n\n# 3. Store this month's export in the cheapest archive class\naws s3 cp ./exports/2026-09.sql.gz s3://lantern-backups/exports/ \\\n --storage-class {{3}}","blanks":[{"answers":["cp"]},{"answers":["recursive"]},{"answers":["Enabled"]},{"answers":["DEEP_ARCHIVE"]}],"title":"Upload, protect and archive","prompt":"Finish three commands for Lantern’s storage. Step 1 copies the local posters/ folder and all its subfolders into the bucket with the copy command. Step 2 turns on versioning. Step 3 uploads a database export that must be kept for seven years at the lowest storage price, where waiting hours for a restore is acceptable. Use the storage class’s API name, in capitals.
aws s3 copy command is two letters, and it needs a flag to descend into folders.","Versioning’s status values are Enabled and Suspended.","The archive class with the lowest storage price and a 180-day minimum is written with an underscore."],"explanation":"aws s3 cp with --recursive copies every file under the folder, keeping the relative paths as key prefixes. (aws s3 sync would also work and only uploads changed files, but it takes no --recursive flag.) Status=Enabled turns versioning on; after that you can only suspend it. --storage-class DEEP_ARCHIVE puts the export straight into S3 Glacier Deep Archive, which has the lowest storage price, a 180-day minimum storage duration and restores measured in hours, a good fit for files you hope never to need.