Storage: Amazon S3, EBS and EFS

On Lantern’s old server, “storage” was one disk that filled up. On AWS you get three different kinds, each shaped for a different job: objects in Amazon S3, block disks in Amazon EBS, and shared files in Amazon EFS. Most of Lantern’s data belongs in the first.

Amazon S3: objects in buckets

S3 stores objects (any bytes, up to 50 TB each) in buckets. An object is addressed by its key, such as posters/2026/street-food-festival.jpg. The slashes look like folders, and the console draws them as folders, but S3 has no directories: the key is one string, and posters/2026/ is a prefix. Bucket names are unique across all of AWS; the bucket itself lives in the Region you choose.

aws s3 mb s3://lantern-posters --region eu-west-1
aws s3 cp ./posters/ s3://lantern-posters/posters/ --recursive
aws s3 ls s3://lantern-posters/posters/2026/

Safe by default, and keep it that way

New buckets come with three protections switched on: Block Public Access (all four settings on), Object Ownership set to bucket owner enforced (access control lists disabled, so only policies grant access), and default encryption with S3-managed keys. You change access with bucket policies, as you did in section two.

Leave Block Public Access on for every bucket that isn’t deliberately public, and set it at the account level too, so a single mistaken bucket can’t become public:

aws s3control put-public-access-block --account-id 111122223333 \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

In section four Lantern’s website is served to the public without making any bucket public: CloudFront reads the bucket privately on visitors’ behalf.

Storage classes: same API, different price shape

Every object has a storage class. They are all designed for the same eleven nines (99.999999999%) of durability; they differ in how you pay.

The price model has three parts: per GB stored per month, per request, and, for the infrequent and archive classes, per GB retrieved. A cheaper storage class with frequent reads can cost more than Standard. Small objects are also a trap: the IA classes bill each object as at least 128 KB.

For Lantern: current posters stay in Standard, posters older than a year move to Glacier Instant Retrieval (they still appear on old event pages), and monthly database exports go to Deep Archive.

Versioning: an undo button with a price

With versioning on, overwriting or deleting an object keeps the old version. A delete adds a delete marker instead of destroying data, so an accidental aws s3 rm is recoverable. Once enabled, versioning can only be suspended, never fully removed.

aws s3api put-bucket-versioning --bucket lantern-posters \
  --versioning-configuration Status=Enabled

Every version is billed as a full object, so pair versioning with a lifecycle rule that moves and expires data automatically:

{
  "Rules": [
    {
      "ID": "age-out-posters",
      "Filter": { "Prefix": "posters/" },
      "Status": "Enabled",
      "Transitions": [{ "Days": 365, "StorageClass": "GLACIER_IR" }],
      "NoncurrentVersionExpiration": { "NoncurrentDays": 30 }
    }
  ]
}

aws s3api put-bucket-lifecycle-configuration --bucket lantern-posters \
  --lifecycle-configuration file://lifecycle.json

Disks for servers: EBS and EFS

Some software needs a real file system. That is where the other two services come in.

Amazon EBS (Elastic Block Store) is a network disk for one EC2 instance, in one Availability Zone. Almost every instance boots from one. gp3 is the general-purpose SSD type to start with. You pay for the provisioned size, not what you fill, so a 500 GB volume holding 20 GB costs the same as a full one. Snapshots back volumes up incrementally to storage that survives the loss of the AZ.

Amazon EFS (Elastic File System) is a managed NFS file system that many instances, across AZs, mount at the same time. It grows and shrinks with your files and bills per gigabyte actually stored, at a higher rate per gigabyte than EBS. Use it when several servers must share one directory tree.

For Lantern, the answer is mostly “neither”: posters live in S3, where Lambda and CloudFront can reach them. The temporary migration server gets one small gp3 volume, and no EFS at all.

Files are settled. Next: the data that changes every second, in a database.