So, now let's talk about S3 Access Points
and then the S3 Object Lambdas.
So, we have an S3 bucket,
and that S3 bucket has two folders.
One contains the Finance Data,
and it's named "/finance/",
and one contains the Sales Data
of company, and it's named "/sales/".
And say we had three groups of Users
that want to access the data in this S3 buckets.
We have the Finance Users/Group,
we have the Sales Users/Group,
and the Analytics Users/Group, okay?
Now we could create a bucket policy
and define what every User has access to,
but if we have more Users and more groups,
the bucket policy can become quite complicated.
So instead, what we're going to do is that
we're going to use this feature called the S3 Access Points.
So we're going to create an Access Points
for the finance team.
So, it's called the Finance AP for Access Points.
So, it's connected to the Finance Data,
and we can have a sales, finance A-access Points
connected to the Sales Data,
and an Analytics Access Point
connected to the Finance and the Sales Data.
So, we've created a layer on top of our three buckets.
Now, we're going to attach a policy
on the Finance Access Points,
and it's going to grant access,
rewrite access to the Finance Users in Group
to the specific /finance prefix.
And therefore, our Users accessing our S3 bucket
through the Finance Access Point
can only read and write the Finance Data.
There, similarly, if we do the same
and attach a policy to the access point
(gurgling)
of the sales team to only do
read and write access to the /sales prefix,
then the sales team can only modify and read the sales data
if they access the bucket through the Access Points.
And then finally, the analytics group, well,
they only need read access, but to all the data.
And therefore we can attach a policy
to the Analytics Access Point
to grant read access to the entire buckets.
And so we've seen how using different Access Points,
we're able to use a specific policy per Access Points
to define how one group may access the Access Points
and therefore may access your S3 buckets.
So each Access Points actually has its own DNS,
and own policy, and this allows to limit
who can access it in terms of users or group.
And so, therefore, because we have
only one policy per access point, it's easier to manage
than very complex and unique bucket policies.
So, once we've defined what Access Points are,
there is another use case for them,
and it's called the S3 object Lambda.
So the idea is that you have an S3 bucket,
but you want to modify the object
just before it is being retrieved by a caller application.
And instead of, for example, duplicating our buckets
to have different versions of each object,
we can use S3 Object Lambda instead.
And for this, we need the S3 Access Points that we just saw.
So, how does that work?
Say we have the Cloud and we have an S3 bucket in it.
So, an eCommerce Application maybe
owns the data in this S3 bucket,
and so they're able to access directly the S3 bucket,
and put and get the original object out of it.
But, then an Analytics Application
may want to only have access to the redacted object.
That means that some data has been deleted from the object.
And so instead of creating a new S3 bucket for this,
what we can do is that we create an S3 Access Point
on top of our S3 bucket,
and it's connected to a Lambda function.
Now we haven't seen Lambda in depth,
but a Lambda function allows you
to run a bit of code in the Cloud very easily.
And so this Lambda function is going to
redact the object as it is being retrieved.
And, on top of this Lambda function,
we're going to create an S3 object, Lambda Access Points.
And this is how the Analytics Application
is going to access our S3 buckets.
So to summarize, the Analytics Application
accesses our S3 object, Lambda Access Points,
which invokes our Lambda function.
Our Lambda function is going to retrieve the data
from the S3 buckets and run some code to redact the data.
And therefore, the Analytics Application
is obtaining a redacted object
from the very same S3 bucket
as the e-Commerce Application.
Now, a marketing application
may want to have access to an enriched objects,
and they have a customer loyalty database
to enhance the data.
So instead of, again, creating a new S3 bucket,
and creating all the objects with all the enriched data,
what we can do is, again, using a Lambda function.
So, another piece of code,
and this one will enrich the data
by looking it up from the customer loyalty database.
And therefore, we can also create
an Object Lambda Access Point on top of it.
And therefore, our Marketing Application
can access this Access Point,
this S3 Object Lambda Access Points,,
to get, again, the enriched objects.
As you can see, we only need one S3 bucket,
but we can create Access points and Object Lambdas
to modify the data as we will.
So, as we wish, so the use cases
for it is to redact, for example, PII data,
so personally identifiable information,
for analytics or non-production environments,
or for example to convert data from XML to JSON,
or to perform any kind of transformation you want,
for example resizing and watermarking images on the fly.
But, the watermark is specific
to the user who request the object.
So that's ki-kind of a cool,
cool usage for S3 Object Lambda.
So, I hope you liked it,
and I will see you in the next lecture.