ECS: How to Configure and Use S3 AWS CLI

Download and install instructions.

1. Version releases https://github.com/aws/aws-cli/releases (External Link)
2. Download and install AWS CLI bundle

# curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip"

3. Extract bundle

# unzip awscli-bundle.zip

4. Run install command

# sudo /awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws

5. Confirm version

# aws version

Output:
      aws-cli/2.0.33 Python/3.7.3 Linux/4.15.0-109-generic botocore/2.0.0dev37

Configuring the AWS CLI

• Access key ID: ECS object user
• Secret Access key: Secret Key

1. This example creates a profile name mc_s3

# aws configure --profile mc_s3

Prompt:

    AWS Access Key ID [None]: mc_s3
    AWS Secret Access Key [None]: 1guFemRLSgqFau6uKzIVAZJu5+PS+S8qO7rvEsi7
    Default region name [None]: 
    Default output format [None]: json

2. List profiles all profiles (list-properties available in AWS CLI v2

# aws configure list-properties

Output:
    mc_s3
    ad_uid1

# aws configure list

Output:
		  Name                    Value             Type    Location
		  ----                    -----             ----    --------
	   profile                <not set>             None    None
	access_key     ****************c_s3 shared-credentials-file    
	secret_key     ****************Esi7 shared-credentials-file    
		region                               config-file    ~/.aws/config

3. List-specific profile

# aws configure get aws_access_key_id --profile mc_s3

Output:
      mc_s3
Dealing with SSL connections and error on self signed certificate.  ( [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1056))

4. If using commands on 9021, AWS CLI option --no-verify-ssl is required to bypass the self-signed certificate error.

# aws --profile mc_s3 --endpoint=https://ecshop:9021 s3api list-buckets

Output:
     SSL validation failed for https://ecshop:9021/mc_s3_bkt?acl [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1056)

• Run command with --no-verify option to bypass this error

# aws --profile mc_s3 --endpoint=https://ecshop:9021 s3api list-buckets --no-verify-ssl --output text

Output:
      
    /usr/local/aws-cli/v2/2.0.33/dist/urllib3/connectionpool.py:986: InsecureRequestWarning: Unverified HTTPS request is being made to host 'ecshop'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings

    BUCKETS 2020-02-24T21:24:29.440000+00:00        mc_s3_bkt
    BUCKETS 2020-05-06T17:23:48.870000+00:00        mc_s3_bkt2_backup
    BUCKETS 2020-05-06T21:16:13.344000+00:00        mc_s3_bkt_nfs
    OWNER   mc_s3   mc_s3

• The second option would be to download the ECS self-signed certificate saved in PEM format and using the --ca-bundle option
• Use OpenSSL to obtain ECS certificate for object data access on port 9021 and copy certificate contents using your favorite editor and save including certificate headers per example below.

# openssl s_client -connect ecshop:9021

Output:

    -----BEGIN CERTIFICATE----- 
    Xxxxxxxxx
    xxxxxxxxx
    ...
    ...
    -----END CERTIFICATE-----

5. List buckets in table human friendly with ca-bundle option where certificate is saved in PEM file name ecshop_cert_pem 

# aws --profile mc_s3 --endpoint=https://ecshop:9021 s3api list-buckets  --ca-bundle ecshop_cert.pem  --output table

Output:
    -------------------------------------------------------------
    |                        ListBuckets                        |
    +-----------------------------------------------------------+
    ||                         Buckets                         ||
    |+-----------------------------------+---------------------+|
    ||           CreationDate            |        Name         ||
    |+-----------------------------------+---------------------+|
    ||  2020-02-24T21:24:29.440000+00:00 |  mc_s3_bkt          ||
    ||  2020-05-06T17:23:48.870000+00:00 |  mc_s3_bkt2_backup  ||
    ||  2020-05-06T21:16:13.344000+00:00 |  mc_s3_bkt_nfs      ||
    |+-----------------------------------+---------------------+|
    ||                          Owner                          ||
    |+-----------------------------------+---------------------+|
    ||            DisplayName            |         ID          ||
    |+-----------------------------------+---------------------+|
    ||  mc_s3                            |  mc_s3              ||
    |+-----------------------------------+---------------------+|

Basic S3 operations

• max_concurrent_requests - The maximum number of concurrent requests
• max_queue_size - The maximum number of tasks in the task queue
• multipart_threshold - The size threshold the CLI uses for multipart transfers of individual files.
• multipart_chunksize - When using multipart transfers, this is the chunk size that the CLI uses for multipart transfers of individual files.
• max_bandwidth - The maximum bandwidth that is consumed for uploading and downloading data to and from Amazon S3.

# cat .aws/config

Output:
    [profile mc_s3]
    output = json
    s3 =
            endpoint_url = http://ecshop:9020

              max_concurrent_requests = 20
              max_queue_size = 1000
              multipart_threshold = 64MB
              multipart_chunksize = 16MB
              max_bandwidth = 50MB/s
              addressing_style = auto 

$ aws configure set default.s3.max_concurrent_requests 20
$ aws configure set default.s3.max_queue_size 10000
$ aws configure set default.s3.multipart_threshold 64MB
$ aws configure set default.s3.multipart_chunksize 16MB
$ aws configure set default.s3.max_bandwidth 50MB/s
$ aws configure set default.s3.addressing_style auto

1. Create bucket using s3 mb command

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 mb s3://s3_bkt

Output:
    make_bucket: s3_bkt

2. List buckets using s3 ls and s3api list-buckets command sets lists buckets, for any other operations (referred to in S3 as 'prefixes') (External Link) in a bucket

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 ls

Output:
   2020-07-29 20:34:24 s3_bkt

  #  aws --profile mc_s3 --endpoint http://ecshop:9020 s3api list-buckets

#  aws --profile mc_s3 --endpoint http://ecshop:9020 s3api list-buckets
Output:		
	 aws --profile mc_s3 --endpoint http://ecshop:9020 s3api list-buckets
	{
		"Buckets": [
			{
				"Name": "mc_s3_bkt",
				"CreationDate": "2020-02-24T21:24:29.440000+00:00"
			},
			{
				"Name": "mc_s3_bkt2_backup",
				"CreationDate": "2020-05-06T17:23:48.870000+00:00"
			},
			{
				"Name": "mc_s3_bkt_nfs",
				"CreationDate": "2020-05-06T21:16:13.344000+00:00"
			},
			{
				"Name": "s3_bkt",
				"CreationDate": "2020-07-30T00:34:24.147000+00:00"
			},

3.  Creating and uploading files for testing 

• Example creating 1 MB and 4 MB files

# dd if=/dev/zero of=1MB_output.file bs=1024 count=1024
# dd if=/dev/zero of=4MB_output.file bs=1024 count=4096

• Example creating large file 2GB

# dd if=/dev/urandom of=bigfile_2GB bs=1024k count=2048

• Upload 1MB file to bucket s3_bkt

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 cp 1MB_output.file s3://s3_bkt

Output:
    upload: ./1MB_output.file to s3://s3_bkt/1MB_output.file

4. List files in bucket, s3_bkt using profile name mc_s3 using s3 ls, or s3api list-objects command sets 

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 ls s3://s3_bkt

Output:
2020-07-29 20:39:43   16.0 MiB 16MB_output.file
2020-07-29 20:37:25    1.0 MiB 1MB_output.file
2020-07-29 20:39:23    4.0 MiB 4MB_output.file

 # aws --profile mc_s3 --endpoint http://ecshop:9020 s3api list-objects --bucket s3_bkt
Output:
	{
		"Contents": [
			{
				"Key": "16MB_output.file",
				"LastModified": "2020-07-30T00:39:43.125000+00:00",
				"ETag": "\"3a2d20e2e504fe056bbaae5b4c2351fd-2\"",
				"Size": 16777216,
				"StorageClass": "STANDARD",
				"Owner": {
					"DisplayName": "mc_s3",
					"ID": "mc_s3"
				}
			},
			{
				"Key": "1MB_output.file",
				"LastModified": "2020-07-30T00:37:25.033000+00:00",
				"ETag": "\"b6d81b360a5672d80c27430f39153e2c\"",
				"Size": 1048576,
				"StorageClass": "STANDARD",
				"Owner": {
					"DisplayName": "mc_s3",
					"ID": "mc_s3"
				}
			},

5. List object versions

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api list-object-versions --bucket s3_bkt --output text

6. Download file, 1MB_output.file from s3_bkt to /tmp directory on local machine.

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 cp s3://s3_bkt/1MB_output.file /tmp/

Output:
     download: s3://s3_bkt/1MB_output.file to ../../tmp/1MB_output.file

7. Check ACL of a file 1MB_output.file in YAML format for output for readability

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api get-object-acl --bucket s3_bkt --key 1MB_output.file  --output yaml

Output:
        
    Grants:
    - Grantee:
        DisplayName: mc_s3
        ID: mc_s3
        Type: CanonicalUser
      Permission: FULL_CONTROL
    Owner:
      DisplayName: mc_s3
      ID: mc_s3

8. Check bucket ACL on bucket s3_bkt

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api get-bucket-acl --bucket s3_bkt --output yaml

Output:      
    Grants:
    - Grantee:
        DisplayName: mc_s3
        ID: mc_s3
        Type: CanonicalUser
      Permission: FULL_CONTROL
    Owner:
      DisplayName: mc_s3
      ID: mc_s3

9. Check bucket version or enable versioning on the bucket

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api get-bucket-versioning --bucket s3_bkt

Output:

    {
        "Status": "Enabled"
    }

10. Initiate multipart upload using s3api API level with a large file 

1. Create a 5GB file:

# time dd if=/dev/urandom of=bigfile_5GB bs=1024k count=5096

2. Start upload

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api create-multipart-upload --bucket s3_bkt --key bigfile_5GB

Output:

    {
        "Bucket": "s3_bkt",
        "Key": "bigfile_5GB",
        "UploadId": "27cb6c45ab5c4c838fb5893263d871d3"
    }

11. List incomplete multipart file uploads https://aws.amazon.com/premiumsupport/knowledge-center/s3-multipart-upload-cli/ (External Link)

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api list-multipart-uploads --bucket s3_bkt

Output:

	{
	    "Uploads": [
	        {
	            "UploadId": "27cb6c45ab5c4c838fb5893263d871d3",
	            "Key": "bigfile_5GB",
	            "Initiated": "2020-07-31T01:10:56.323000+00:00",
	            "StorageClass": "STANDARD",
	            "Owner": {
	                "DisplayName": "mc_s3",
	                "ID": "mc_s3"
	            }
	        }
	    ]
	}

12. Improve s3 cp command or bucket to bucket performance recommendations for large files to initiate multipart uploads and changing concurrent threads, see above under performance tuning.

13. Perform bucket to bucket copy to copy file.txt in mc_s3_bkt to s3_bkt using S3api 

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api copy-object --copy-source mc_s3_bkt/file.txt --key file.txt --bucket s3_bkt

Output:
{
    "VersionId": "1596159769267",
    "CopyObjectResult": {
        "ETag": "\"c789e490a90359de2bd3b09d7e957cfd-128\"",
        "LastModified": "2020-07-31T01:42:49.267000+00:00"
    }
}

14. List files (objects or keys) in a bucket 

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 ls s3://s3_bkt/file.txt --human-readable  summarize

Output:
      2020-07-30 21:42:49    1.0 GiB file.txt

15. Copying a file from S3_bkt to mc_s3_bkt using s3 cp high-level command set

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 cp s3://s3_bkt/file.txt s3://mc_s3_bkt/file2.txt

       Output:
         copy: s3://s3_bkt/file.txt to s3://mc_s3_bkt/file2.txt

16. Check if versioning is enabled on bucket s3_bkt

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api get-bucket-versioning --bucket s3_bkt

Output: 

      {
          "Status": "Enabled"
      }

17. Delete bucket using s3 rb command (command has no output)

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3 rm s3://s3_bkt2

18. The following example deletes all objects and sub folders in the bucket and then removes the bucket. (if versioning is enabled, this command does not remove version objects (review LDS, Life cycle policies)

# aws s3 rb s3://bucket-name --force

19. Enable versioning on bucket s3_bkt using s3api API level command set (command has not output)

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api put-bucket-versioning --bucket s3_bkt --versioning-configuration Status=Enabled 

20. Applying Life cycle policy Generate template (Reference ECS Data Access guide) AWS CLI requires json format for life cycle policy

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api put-bucket-lifecycle-configuration --generate-cli-skeleton input --bucket s3_bkt

21. Apply Bucket life policy on bucket, for more details reference the ECS Data Access Guide

#  aws --profile mc_s3 --endpoint http://ecshop:9020 s3api put-bucket-lifecycle --bucket s3_bkt --lifecycle-configuration file://s3_bkt_lifecycle.json

Output:

{
   "Rules": [
   {
      "ID": "expire-non-current-and-dmarkers-and-mpu",
      "Status": "Enabled",
      "Prefix": "/",
      "Expiration": {
         "ExpiredObjectDeleteMarker": true
      },
      "AbortIncompleteMultipartUpload": {
         "DaysAfterInitiation": 7
      },
      "NoncurrentVersionExpiration": {
         "NoncurrentDays": 7
      }
   }
   ]
}

22. GET life cycle policy

# aws --profile mc_s3 --endpoint http://ecshop:9020 s3api get-bucket-lifecycle --bucket s3_bkt

Output:

{
    "Rules": [
        {
            "Expiration": {
                "Days": 10
            },
            "ID": "DeleteVersion-musa",
            "Prefix": "",
            "Status": "Enabled",
            "NoncurrentVersionExpiration": {
                "NoncurrentDays": 10
            }
        }
    ]
}