Lab: S3 storage with LocalStack with correction

What you will learn in this TP

• Use LocalStack and awslocal
• Secure a bucket (versioning, encryption, policy)
• Automate object lifecycle

Introduction #

What you will learn in this section

• Use LocalStack and awslocal
• Secure a bucket (versioning, encryption, policy)
• Automate object lifecycle

Context. Your team wants to store exports and publish static documentation. Before touching the real account, you validate the setup on LocalStack.

Prerequisites: Docker, the AWS CLI and LocalStack (pip install localstack awscli-local terraform-local): everything runs locally, with no AWS account or charges  ·  Estimated time: 45 min

A bucket following best practices and a static site served locally.

Hands-on #

Guided steps, with their solution.

1. 1. Start LocalStack

   Why? LocalStack exposes all emulated services on port 4566; awslocal is the AWS CLI preconfigured for this endpoint.

   Start LocalStack in the background, check service status and the returned identity.
   See the correction

   localstack start -d
   localstack status services | head -20
   awslocal sts get-caller-identity          # compte fictif 000000000000
   export AWS_DEFAULT_REGION=eu-west-3

2. 2. Create a versioned, encrypted bucket

   Why? Versioning protects against accidental deletions; default encryption applies to every new object.

   Create exports-equipe, enable versioning and default encryption, upload a file twice and list its versions.
   See the correction

   awslocal s3 mb s3://exports-equipe
   awslocal s3api put-bucket-versioning --bucket exports-equipe --versioning-configuration Status=Enabled
   awslocal s3api put-bucket-encryption --bucket exports-equipe \
     --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'
   echo "v1" > rapport.csv && awslocal s3 cp rapport.csv s3://exports-equipe/2026/
   echo "v2" > rapport.csv && awslocal s3 cp rapport.csv s3://exports-equipe/2026/
   awslocal s3api list-object-versions --bucket exports-equipe --prefix 2026/rapport.csv --query 'Versions[].[VersionId,IsLatest]'

3. 3. Enforce TLS with a bucket policy

   Why? Denying unencrypted requests is a classic security audit control.

   Apply a policy denying any request where aws:SecureTransport is false, then read it back.
   See the correction

   cat > politique.json <<'EOF'
   {"Version":"2012-10-17","Statement":[{"Sid":"TLSUniquement","Effect":"Deny","Principal":"*","Action":"s3:*",
    "Resource":["arn:aws:s3:::exports-equipe","arn:aws:s3:::exports-equipe/*"],
    "Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}
   EOF
   awslocal s3api put-bucket-policy --bucket exports-equipe --policy file://politique.json
   awslocal s3api get-bucket-policy --bucket exports-equipe --query Policy --output text | python3 -m json.tool

4. 4. Automate the lifecycle

   Why? Moving old exports to a cheaper class reduces the bill without manual work.

   Add a rule: STANDARD_IA at 30 days, DEEP_ARCHIVE at 180 days, delete old versions at 90 days.
   See the correction

   cat > cycle.json <<'EOF'
   {"Rules":[{"ID":"archiver","Status":"Enabled","Filter":{"Prefix":"2026/"},
     "Transitions":[{"Days":30,"StorageClass":"STANDARD_IA"},{"Days":180,"StorageClass":"DEEP_ARCHIVE"}],
     "NoncurrentVersionExpiration":{"NoncurrentDays":90}}]}
   EOF
   awslocal s3api put-bucket-lifecycle-configuration --bucket exports-equipe --lifecycle-configuration file://cycle.json
   awslocal s3api get-bucket-lifecycle-configuration --bucket exports-equipe

5. 5. Publish a static site and share a temporary link

   Why? S3 serves static sites; a presigned link grants time-limited access without making the bucket public.

   Create the docs-site bucket, enable website hosting, sync a folder and open the site; generate a 15-minute presigned link to the report.
   See the correction

   mkdir -p site && echo '<h1>Documentation</h1>' > site/index.html
   awslocal s3 mb s3://docs-site
   awslocal s3 website s3://docs-site --index-document index.html
   awslocal s3 sync site s3://docs-site --delete
   curl -s http://docs-site.s3-website.localhost.localstack.cloud:4566/
   awslocal s3 presign s3://exports-equipe/2026/rapport.csv --expires-in 900

Difficulty level : ●●○○○ (2/5)