India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Amazon S3, EBS, EFS & CloudFront CDN Services in India
Amazon S3 is AWS's object storage service, designed for 99.999999999% durability, and Amazon CloudFront is its content delivery network that caches that content at edge locations close to users. NTSPL designs S3 storage-class tiering, EBS and EFS volumes and CloudFront distributions for Indian media, engineering and healthcare organizations so that hot data stays fast, cold data gets cheap and delivery survives traffic peaks.
AWS services in scope
The Problem Amazon S3 and Amazon S3 storage classes and S3 Intelligent-Tiering Solve
Storage bills grow quietly. A typical estate we review has 70-80% of its S3 bytes in S3 Standard even though most objects have not been read for six months, gp2 volumes over-provisioned simply to get more IOPS, and a CDN that misses cache on every new episode or drawing set because the cache key includes a tracking parameter. Meanwhile, file servers on-premises run out of space every year, and nobody can say which of 400 TB of images can legally be deleted. The real problem is placing each byte on the storage class and delivery path that matches its access pattern and retention obligation.
NTSPL starts with S3 Storage Lens and S3 Inventory to map bytes by age, prefix and last access, then sets lifecycle rules or Intelligent-Tiering per dataset rather than per bucket. Block volumes are moved to gp3 or io2 against measured IOPS, shared file workloads go to EFS or the right FSx flavour, and CloudFront is tuned with explicit cache policies, Origin Shield and origin access control so the origin bucket is never public. Every retention rule is written down against a business or regulatory owner.
When Amazon S3, EFS, FSx and CloudFront Are the Right Storage Answer
Signals that point to storage & content delivery on AWS
- S3 Storage Lens shows more than half your bytes in S3 Standard with no reads in the last 90 days.
- Your on-premises NAS or file server crosses 80% capacity and the next hardware refresh is quoted in crores.
- Your video or download origin sees bandwidth spikes of 10x or more when new content is published.
- EBS volumes are still gp2 and were enlarged only to gain IOPS.
- Auditors or regulators ask you to prove that records cannot be altered or deleted before a retention date.
- Users in tier-2 and tier-3 cities report slow image or video start times while metro users are fine.
When a different approach is better
- Transactional data needing queries, joins and row-level updates belongs in Amazon RDS, Aurora or DynamoDB, not as JSON files in S3.
- Live, two-way, sub-second interactive video such as video calls needs Amazon Chime SDK or Amazon IVS real-time streaming rather than CloudFront-cached HLS segments.
- A single small Windows team share of a few hundred gigabytes may be simpler to host on SharePoint Online or OneDrive than on Amazon FSx for Windows File Server.
AWS Storage Building Blocks: S3 Storage Classes, EBS Volume Types, EFS, FSx and CloudFront
| Service | Role in the architecture | Choose it when |
|---|---|---|
| Amazon S3 | Stores objects of any size in buckets with versioning, replication, Object Lock and event notifications, acting as the system of record for media, documents and backups. | Data is written once and read many times by applications, users or analytics through an API rather than a mounted file system. |
| Amazon S3 storage classes and S3 Intelligent-Tiering | Places objects in Standard, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval or Glacier Deep Archive, or lets Intelligent-Tiering move them automatically based on access. | Access frequency drops predictably with age, or is unknown, and storage is a growing share of the monthly bill. |
| Amazon EBS (gp3, io2 Block Express) | Provides block volumes for EC2 instances, with gp3 decoupling IOPS and throughput from size and io2 Block Express serving latency-sensitive databases needing very high IOPS and durability. | A single instance needs a low-latency disk for a database, application server or boot volume. |
| Amazon EFS | Offers a managed, elastic NFS file system mountable by many Linux instances and containers across Availability Zones, with lifecycle management to Infrequent Access and Archive classes. | Several Linux servers or containers must share the same files, such as CMS uploads, render scratch or home directories. |
| Amazon FSx (for Windows File Server, for NetApp ONTAP, for Lustre) | Delivers fully managed file systems with native SMB and Active Directory integration, NetApp multiprotocol features, or high-throughput Lustre linked to S3. | You are replacing a Windows or NetApp file server with existing shares and permissions, or need parallel file throughput for HPC and media processing. |
| Amazon CloudFront | Caches and delivers static files, video segments and APIs from a global network of edge locations, including several Indian cities, with signed URLs, field-level controls and AWS WAF integration. | Users are spread across many cities or countries, or origin egress and origin load spike when content is released. |
| AWS DataSync and AWS Storage Gateway | Move bulk data from on-premises NAS to S3, EFS or FSx with verification, and give on-premises applications a local cache in front of cloud storage. | Tens of terabytes need to move over the network with integrity checks, or plant and site offices must keep local SMB or NFS access. |
Tiered object store with edge delivery and hybrid file access
Tiered object store with edge delivery and hybrid file access
Users and devices fetch content through CloudFront, which serves from edge cache, then from Origin Shield in the Mumbai area, and only then from a private S3 bucket reached through origin access control. Uploads arrive by presigned URLs or DataSync, land in S3 Standard and are moved by lifecycle rules or Intelligent-Tiering to colder classes, with cross-Region replication to Hyderabad for critical datasets.
Select any component
Tiered object store with edge delivery and hybrid file access: click any of its 9 components to see its role and the design choice NTSPL makes for it, or trace the 5-step primary path.
Storage Engineering Decisions: Lifecycle Rules, Minimum Durations, Volume Types and Cache Keys
Lifecycle rules vs Intelligent-Tiering
Where access decays predictably with age, such as site photos or completed project drawings, explicit lifecycle rules are cheaper because there is no per-object monitoring fee. Where access is unpredictable, such as a back catalogue where any title can trend, Intelligent-Tiering avoids retrieval charges. Objects below 128 KB are not auto-tiered by Intelligent-Tiering, so buckets with millions of thumbnails need a different plan, often aggregation or staying in Standard.
Minimum durations and retrieval economics
Standard-IA and One Zone-IA have a 30-day minimum, Glacier Instant Retrieval and Flexible Retrieval 90 days, and Deep Archive 180 days, with per-GB retrieval charges on infrequent and archive classes. We model the read rate per prefix before transitioning: if more than roughly a quarter of objects are read monthly, Standard-IA can cost more than Standard. Deep Archive is reserved for data you expect to restore rarely and can wait up to 12 hours for.
EBS volume type selection
gp3 is the default for boot and most application volumes because it gives 3,000 IOPS and 125 MiB/s at any size, with extra IOPS and throughput bought separately. io2 Block Express is justified only for databases with sustained high IOPS needs or strict latency, measured from CloudWatch VolumeReadOps and queue length. st1 and sc1 suit large sequential workloads. Moving gp2 to gp3 is an online modification, so we do it without downtime.
CloudFront cache key and TTL design
Cache hit ratio is decided by the cache key. We use managed or custom cache policies that include only the headers, cookies and query strings the origin actually varies on, strip analytics parameters, and version file names so content can carry TTLs of a year. Video manifests get short TTLs and segments long ones. We target a hit ratio above 90% for media and above 95% for static web assets, monitored in CloudFront reports.
File system choice: EFS vs FSx
EFS fits Linux and container workloads needing shared NFS storage with elastic size. FSx for Windows File Server fits SMB shares with Active Directory permissions, DFS namespaces and shadow copies users already rely on. FSx for NetApp ONTAP fits estates already using NetApp snapshots, SnapMirror or multiprotocol access. FSx for Lustre is for high-throughput compute scratch linked to S3. We pick by protocol and permission model first, then throughput.
How NTSPL Migrates and Tiers Storage onto Amazon S3 and CloudFront
S3 Inventory and access-pattern mapping
Enable S3 Inventory, Storage Lens and server access logs, or scan on-premises NAS metadata, to group data by prefix, age, object size and last access.
Bucket layout and lifecycle policy design
Define bucket and prefix structure, versioning, encryption, Object Lock and per-prefix lifecycle or Intelligent-Tiering rules, modelled against minimum durations and retrieval fees.
Bulk transfer with DataSync over Direct Connect
Seed data with DataSync tasks over Direct Connect or a partner offline transfer, verify checksums, then run incremental syncs until the cutover freeze.
File system and volume cutover
Move shares to FSx or EFS with permissions intact and convert gp2 volumes to gp3 online, sizing IOPS and throughput from CloudWatch metrics.
CloudFront distribution and cache tuning
Create the distribution with origin access control, cache policies, Origin Shield and signed URLs or cookies, then shift traffic gradually by DNS weight while watching hit ratio.
Replication and restore drill
Enable Cross-Region Replication to Hyderabad where required and restore a sample from each storage class to prove recovery times.
What you receive
Securing Buckets and Distributions: Block Public Access, Origin Access Control and Object Lock
Storage breaches in India rarely involve sophisticated attacks; they involve a public bucket, a leaked access key or an origin reachable around the CDN. NTSPL enforces S3 Block Public Access at the account level, serves content only through CloudFront with origin access control, uses signed URLs or cookies for paid or private content, and scans buckets with Macie so personal data covered by the DPDP Act 2023 is found and governed.
- S3 Block Public Access at account and bucket level to stop accidental public exposure
- CloudFront origin access control so S3 origins accept requests only from the distribution
- S3 Object Lock in compliance mode for records that must not be deleted before their retention date
- SSE-KMS with S3 Bucket Keys and key policies limiting decrypt access per application role
- CloudFront signed URLs or signed cookies with short expiry for premium or patient-specific content
S3 and CloudFront Pricing Levers: Storage Classes, Retrievals, Requests and Cache Hit Ratio
S3 is billed on GB-month per storage class, requests, retrievals for infrequent and archive classes, and data transfer out; CloudFront is billed on data transfer to viewers and HTTP requests, with data transfer from AWS origins to CloudFront not charged. EBS is billed on provisioned GB, plus provisioned IOPS and throughput above gp3 baselines. Optimization means fewer bytes in hot classes and fewer requests reaching the origin.
- Lifecycle transitions to Glacier Instant Retrieval or Deep Archive for aged prefixes
- Higher CloudFront cache hit ratio and Origin Shield to reduce origin egress and request charges
- gp2 to gp3 conversion and removal of unattached EBS volumes and old snapshots
- Expiring noncurrent object versions and incomplete multipart uploads with lifecycle rules
- CloudFront security savings bundle or committed pricing for steady, high-volume delivery
Amazon S3 vs EFS vs FSx: which AWS storage should I use?
Decide by access method first. If applications read and write whole files through an API or HTTP, choose S3: it is the cheapest per GB, scales without limit and tiers to archive automatically. If many Linux servers or containers need a shared POSIX file system, choose EFS, which grows and shrinks automatically. If users and Windows applications need SMB shares with Active Directory permissions, choose FSx for Windows File Server; for NetApp-style snapshots and replication, FSx for NetApp ONTAP; for high-throughput HPC scratch, FSx for Lustre. Then check cost: per GB, S3 is lowest, file systems cost more for the convenience of mounting. Many estates use S3 as the long-term store and a file system only for active working sets.
Key facts about storage & content delivery on AWS
Storage & Content Delivery on AWS in Practice
3 storage & content delivery scenarios from Media and entertainment (regional-language OTT streaming), EPC and infrastructure construction, Healthcare (diagnostic imaging and pathology chain): the starting position, the services chosen, the architecture, the rollout and the measured outcome.
Regional-language OTT service halves video start time and cuts origin egress by 82%
EPC contractor consolidates 11 site file servers and 380 TB of drawings onto FSx and S3
Diagnostics chain tiers 1.4 PB of medical imaging and cuts archive cost by 63%
D2C fashion brand absorbs 14x festive flash-sale traffic with zero checkout outages
Auto components maker cuts CAE simulation queue from 3 days to 6 hours with Spot bursts
General insurer cuts motor-claim intake from 2 days to 25 minutes with serverless
Storage & Content Delivery on AWS: Frequently Asked Questions
How is Amazon S3 storage priced?
S3 charges per GB stored each month, with the rate depending on storage class, plus per-request charges for reads and writes, retrieval charges for infrequent-access and Glacier classes, and data transfer out to the internet. Archive classes are far cheaper per GB but carry minimum storage durations and retrieval fees, so we model access patterns before moving data.
Is S3 Intelligent-Tiering always the cheapest choice?
No. Intelligent-Tiering charges a small monthly monitoring fee per object and does not auto-tier objects smaller than 128 KB. For datasets whose access drops predictably with age, explicit lifecycle rules usually cost less. Intelligent-Tiering is best for large objects with unpredictable access, where it avoids retrieval charges and manual tuning.
How do we move 200 TB of on-premises files to AWS?
For a few hundred terabytes over a stable 1 Gbps or faster link, AWS DataSync can move data in scheduled windows with checksum verification and incremental syncs before cutover. Where bandwidth is limited, a partner-led offline transfer seeds the bulk copy (AWS Snowball Edge is no longer offered to new customers). NTSPL typically seeds the bulk copy, runs incremental syncs for a week, then cuts users over in a short freeze.
Can we keep all our storage data inside India?
Yes. S3 buckets, EBS volumes, EFS and FSx file systems stay in the Region you create them in, such as Asia Pacific (Mumbai) or Asia Pacific (Hyderabad), unless you configure replication elsewhere. This helps meet data residency expectations under the DPDP Act 2023 and sector guidance. CloudFront caches copies at edge locations, so for strictly in-country content we restrict the distribution's price class and geography accordingly.
Does CloudFront have edge locations in India?
Yes. CloudFront operates edge locations in several Indian metros, including Mumbai, Chennai, New Delhi, Hyderabad, Bengaluru and Kolkata, which shortens time-to-first-byte for users across the country. Viewers in smaller towns are served from the nearest metro edge. Origin Shield further reduces load on the origin bucket in Mumbai.
How do we stop someone deleting our backups or records?
Enable S3 Versioning and S3 Object Lock in compliance mode, which prevents any user, including the root account, from deleting or overwriting an object version until its retention date. Combine it with AWS Backup Vault Lock for EBS, EFS and FSx backups. This is a strong defence against ransomware and insider deletion, but retention must be set carefully because it cannot be shortened.