aws-storage

Start by confirming the actual caller with aws sts get-caller-identity, then check the bucket policy, IAM policy, Block Public Access settings, and KMS key permissions if SSE-KMS is used. CloudTrail logs reveal the exact errorCode and requestParameters causing the denial.

Check the VolumeQueueLength CloudWatch metric; sustained values above 1 indicate the volume cannot keep up. For gp2 volumes, verify BurstBalance is not depleted, and consider migrating to gp3 to provision IOPS and throughput independently of volume size.

Connection timeouts usually mean the mount target security group does not allow inbound NFS traffic on port 2049, or no mount target exists in the instance's Availability Zone. Verify DNS resolution, security group rules, and mount target state with the AWS CLI.

gp3 provides a baseline of 3000 IOPS and 125 MiB/s regardless of size, with independently provisionable IOPS up to 16000, while gp2 scales at 3 IOPS per GB with bursting. gp3 is typically 20% cheaper and migration is done online via aws ec2 modify-volume.

Replication requires versioning enabled on both source and destination buckets, an IAM role with s3:ReplicateObject permissions, and an enabled replication rule. Only new objects replicate automatically; existing objects need S3 Batch Replication, and SSE-C encrypted objects are never replicated.

Elastic throughput mode suits spiky or unpredictable workloads because it automatically scales up to 10 GiB/s read and charges only for throughput consumed. Bursting mode ties baseline throughput to file system size and throttles to baseline once BurstCreditBalance is depleted.