对象存储(S3/OSS/COS)提供无限容量、高可用、按用量付费的非结构化数据存储，是备份、静态网站、CI/CD制品的理想后端。
Bucket（桶）→ 顶层命名空间，全局唯一 ├── Object → 文件+元数据+Key（最大5TB） ├── Prefix → 模拟目录结构 ├── Version → 启用版本控制后每个版本有ID └── Lifecycle → 自动过期/转储规则
| 存储类型 | 访问频率 | 最小存储期 | 价格倍数 | 适用场景 |
|---|---|---|---|---|
| Standard | 频繁 | 无 | 1x | 网站、热数据 |
| Infrequent Access | 月级 | 30天 | 0.5x | 备份、日志 |
| Glacier/Archive | 年级 | 90天 | 0.1x | 归档、合规 |
| Glacier Deep | 年级 | 180天 | 0.03x | 长期归档 |
# 创建Bucket(启用版本控制+加密)
aws s3api create-bucket --bucket my-devops-artifacts-2026 --region ap-southeast-1 --create-bucket-configuration LocationConstraint=ap-southeast-1
aws s3api put-bucket-versioning --bucket my-devops-artifacts-2026 --versioning-configuration Status=Enabled
aws s3api put-bucket-encryption --bucket my-devops-artifacts-2026 --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"},"BucketKeyEnabled":true}]}'
# 上传文件
aws s3 cp app-v1.2.3.tar.gz s3://my-devops-artifacts-2026/builds/app/
aws s3 sync ./dist/ s3://my-devops-artifacts-2026/static/ --delete
# 预签名URL(限时访问)
aws s3 presign s3://my-devops-artifacts-2026/builds/app/app-v1.2.3.tar.gz --expires-in 3600
# 分段上传大文件
aws s3 cp large-dataset.tar.gz s3://my-devops-artifacts-2026/data/ --expected-size 5368709120cat > lifecycle.json << 'EOF'
{
"Rules": [
{
"ID": "LogArchiveRule",
"Status": "Enabled",
"Filter": {"Prefix": "logs/"},
"Transitions": [
{"Days": 30, "StorageClass": "STANDARD_IA"},
{"Days": 90, "StorageClass": "GLACIER"},
{"Days": 365, "StorageClass": "DEEP_ARCHIVE"}
],
"Expiration": {"Days": 2555}
},
{
"ID": "BuildCleanup",
"Status": "Enabled",
"Filter": {"Prefix": "builds/"},
"NoncurrentVersionExpiration": {"NoncurrentDays": 30},
"Expiration": {"Days": 90}
}
]
}
EOF
aws s3api put-bucket-lifecycle-configuration --bucket my-devops-artifacts-2026 --lifecycle-configuration file://lifecycle.jsonaws s3api create-bucket --bucket my-static-site-2026 --region us-east-1
aws s3api delete-public-access-block --bucket my-static-site-2026
cat > website.json << 'EOF'
{"IndexDocument":{"Suffix":"index.html"},"ErrorDocument":{"Key":"404.html"}}
EOF
aws s3api put-bucket-website --bucket my-static-site-2026 --website-configuration file://website.json
aws s3 sync ./site/ s3://my-static-site-2026/ --acl public-read --cache-control "max-age=86400"
# Bucket Policy允许公开读
cat > bucket-policy.json << 'EOF'
{"Version":"2012-10-17","Statement":[{"Sid":"PublicRead","Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-static-site-2026/*"}]}
EOF
aws s3api put-bucket-policy --bucket my-static-site-2026 --policy file://bucket-policy.json
echo "URL: http://my-static-site-2026.s3-website-us-east-1.amazonaws.com" # 安装ossutil
curl -o ossutil64 https://gosspublic.alicdn.com/ossutil/1.7.18/ossutil-v1.7.18-linux-amd64.zip
unzip ossutil64.zip && chmod +x ossutil && sudo mv ossutil /usr/local/bin/
ossutil config # 配置Endpoint/AccessKey
ossutil mb oss://my-devops-bucket --storage-class Standard --acl private
ossutil cp ./app.tar.gz oss://my-devops-bucket/artifacts/
ossutil sync ./dist/ oss://my-devops-bucket/static/ --delete
ossutil du oss://my-devops-bucket/ --storage-class Standard
ossutil sign oss://my-devops-bucket/artifacts/app.tar.gz --timeout 3600┌─────────────────────────────────────────────────┐ │ 应用层 │ │ Web / Mobile / CI/CD / Data Pipeline │ └──────────────────────┬──────────────────────────┘ ┌──────────────────────▼──────────────────────────┐ │ 对象存储服务 │ │ builds/ → Standard (热数据) │ │ logs/ → IA → Glacier → Archive │ │ backup/ → IA (30天后自动分层) │ │ static/ → Standard + CDN缓存 │ │ 加密(KMS) + 版本控制 + 生命周期 + 跨区域复制 │ └─────────────────────────────────────────────────┘
aws iam get-user-policy --user-name devops-user --policy-name S3Access
aws s3api get-bucket-policy --bucket my-devops-artifacts-2026
aws s3api get-public-access-block --bucket my-devops-artifacts-2026
# 修复：添加IAM策略
aws iam put-user-policy --user-name devops-user --policy-name S3Write --policy-document '{
"Version":"2012-10-17","Statement":[{
"Effect":"Allow","Action":["s3:PutObject","s3:GetObject","s3:ListBucket"],
"Resource":["arn:aws:s3:::my-devops-artifacts-2026","arn:aws:s3:::my-devops-artifacts-2026/*"]
}]}'掌握S3/OSS核心操作、生命周期分层、静态网站托管——对象存储是云上数据的基石
| 安全措施 | 配置方法 | 重要性 |
|---|---|---|
| 启用版本控制 | put-bucket-versioning Status=Enabled | ⭐⭐⭐ |
| 启用加密 | SSE-KMS或SSE-S3 | ⭐⭐⭐ |
| 禁止公开访问 | Block Public Access | ⭐⭐⭐ |
| 预签名URL | 限时访问而非公开 | ⭐⭐ |
| MFA删除 | 要求MFA才能删除对象 | ⭐⭐ |
| 访问日志 | 启用Server Access Logging | ⭐⭐ |
# 启用跨区域复制（灾备）
aws s3api put-bucket-replication \
--bucket my-devops-artifacts-2026 \
--replication-configuration '{
"Role": "arn:aws:iam::123:role/s3-replication",
"Rules": [{
"ID": "replicate-all",
"Status": "Enabled",
"Destination": {
"Bucket": "arn:aws:s3:::my-devops-artifacts-dr",
"StorageClass": "STANDARD_IA"
}
}]
}'
# 验证复制状态
aws s3api get-bucket-replication --bucket my-devops-artifacts-2026