aws-storage
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseOverview
概述
This skill provides domain expertise for choosing among AWS storage services, selecting storage classes, optimizing cost, and routing to resources for operating storage services. It covers object storage (S3 General Purpose buckets and their storage classes, S3 Express One Zone on directory buckets, S3 Tables, S3 Vectors), file storage (Amazon EFS, S3 Files, FSx for Lustre, FSx for NetApp ONTAP, FSx for OpenZFS, and FSx for Windows File Server), block storage (EBS volume types and EC2 instance store), and the data-movement and protection services that connect them (DataSync, Storage Gateway, Transfer Family, and AWS Backup). It does not advise on databases or analytics query engines. It works with or without the AWS MCP server; when available, the AWS MCP server is recommended for verifying current specifications and pricing, and all guidance also works with the standard AWS CLI. For deep single-service tasks, route to the specialized skills listed in the Routing section below.
该技能提供AWS存储服务选型、存储类别选择、成本优化以及存储服务运维资源指引的领域专业知识。它涵盖对象存储（S3通用型存储桶及其存储类别、目录存储桶上的S3 Express One Zone、S3 Tables、S3 Vectors）、文件存储（Amazon EFS、S3 Files、FSx for Lustre、FSx for NetApp ONTAP、FSx for OpenZFS和FSx for Windows File Server）、块存储（EBS卷类型和EC2实例存储），以及连接这些服务的数据迁移与保护服务（DataSync、Storage Gateway、Transfer Family和AWS Backup）。它不提供数据库或分析查询引擎相关建议。该技能可在有或无AWS MCP服务器的环境下使用；若环境可用，建议使用AWS MCP服务器验证当前规格和定价，所有指引也适用于标准AWS CLI。对于深度单服务任务，请路由至下方路由部分列出的专业技能。
How to Handle User Queries
如何处理用户查询
When this skill is triggered, classify the user's request and follow the appropriate path.
触发该技能后，需对用户请求进行分类并遵循相应路径处理。
Rules
规则
These apply to all responses regardless of path:
- You MUST verify current numbers. When the AWS MCP server is available, use search_documentation and read_documentation to cross-check before citing specifics. When quoting costs, you MUST include a link to the relevant pricing page. When quoting performance metrics, you MUST include a link to the relevant product page. Otherwise, verify against linked AWS documentation pages or use the AWS CLI to confirm current values. Where a reference file directs you to documentation for a current value, you MUST retrieve that value from the linked page before answering. Do not substitute a remembered figure, and do not offer an approximation or a range in place of a retrieved value. If retrieval is not possible in the current environment, name the value you could not verify rather than citing one from memory.
- You MUST retrieve the relevant service reference file from the Routing section below before answering questions about that service. AWS storage specifications, limits, and service capabilities change frequently. You MUST NOT answer from memory alone. You MUST surface relevant troubleshooting guidance and 'gotchas' from reference files in your response. Justify recommendations by workload fit, not by mentioning that a reference file 'explicitly' mentions a workload for a given service.
- You MUST include cost implications when recommending services or approaches. Do not wait for the user to ask. Do not compare services on storage charges alone; per-object fees such as metadata charges can materially change TCO. For deep cost analysis, monitoring, or optimization beyond storage selection, route to the skill.
billing-and-cost-management - You MUST have clarity on the user's need when making a recommendation. Match the specificity of your response to the specificity of the request. When the query determines the storage category and the relevant services, retrieve information and recommend directly. When the query is not fully specified, YOU MUST mention the assumptions and limitations of your recommendation and include the additional questions that would confirm or change it. Ask follow up questions in place of a recommendation only when the query does not let you determine the storage category at all. Recommend the best-fit service for the workload even when it falls outside this skill's scope; add relevant in-scope options as alternatives.
以下规则适用于所有路径的响应：
- 必须验证当前数据。若AWS MCP服务器可用，在引用具体信息前需使用search_documentation和read_documentation进行交叉核对。引用成本时，必须包含相关定价页面的链接；引用性能指标时，必须包含相关产品页面的链接。否则，需通过链接的AWS文档页面验证或使用AWS CLI确认当前值。若参考文件指引您从文档获取当前值，必须先从链接页面获取该值再作答。不得使用记忆中的数值替代，不得提供近似值或范围值。若当前环境无法获取该值，需说明无法验证的数值，而非引用记忆中的内容。
- 在回答某服务相关问题前，必须从下方路由部分获取相关服务参考文件。AWS存储的规格、限制和服务功能会频繁变更。不得仅凭记忆作答。必须在响应中呈现参考文件中的相关故障排查指引和注意事项。需根据工作负载适配性来证明推荐的合理性，而非提及参考文件“明确”指出某服务适用于某工作负载。
- 在推荐服务或方案时，必须包含成本影响分析。无需等待用户询问。不得仅基于存储费用对比服务；元数据费用等按对象收取的费用会显著影响总拥有成本（TCO）。若需进行存储选型之外的深度成本分析、监控或优化，请路由至技能。
billing-and-cost-management - 做出推荐前，必须明确用户需求。响应的详细程度需与请求的详细程度匹配。若查询已确定存储类别和相关服务，可直接获取信息并给出推荐。若查询信息不完整，必须说明推荐的假设前提和局限性，并列出可确认或改变推荐的补充问题。仅当查询完全无法确定存储类别时，才需通过后续提问替代直接推荐。即使最佳适配服务超出本技能范围，仍需推荐该服务；同时补充范围内的相关选项作为替代方案。
Step 1: Classify Intent
步骤1：分类意图
Determine what the user needs:
| Intent | Example Triggers | What this means |
|---|---|---|
| SELECT | "What should I use?", "Which service?", "Compare Service A vs Service B", "Help me choose", "I want to migrate X to AWS" (workload description without a named service) | User needs help choosing a storage service or approach |
| INVESTIGATE | "How do I configure Service X?", "Why is Service Y failing?", "What are the limits of Service Z?", "How do I get started with Service X?" (names a specific service and asks an operational question) | User knows what they are using and needs getting started, troubleshooting, or operational help |
You MUST follow the interaction logic in the corresponding path instructions below.
Ambiguous cases: If the user's primary ask is a recommendation, it is SELECT regardless of context. If they need help executing a known plan, it is INVESTIGATE.
确定用户需求：
| 意图 | 触发示例 | 含义 |
|---|---|---|
| SELECT | "我应该用什么？", "选哪个服务？", "对比服务A和服务B", "帮我选择", "我想把X迁移到AWS"（未指定服务的工作负载描述） | 用户需要帮助选择存储服务或方案 |
| INVESTIGATE | "如何配置服务X？", "服务Y为什么故障？", "服务Z的限制是什么？", "如何开始使用服务X？"（指定具体服务并询问运维问题） | 用户明确使用的服务，需要入门、故障排查或运维帮助 |
必须遵循对应路径说明中的交互逻辑。
模糊场景：若用户主要需求是获取推荐，则无论上下文如何，均归为SELECT意图；若用户需要帮助执行已知计划，则归为INVESTIGATE意图。
Step 2a: SELECT Path
步骤2a：SELECT路径
The user needs help choosing. You MUST use the following decision factors to inform your recommendation, asking questions to fill gaps that would change the choice.
Decision Factors:
| # | Decision Factor | What to understand |
|---|---|---|
| 1 | Workload Context | Is this a new workload or a migration of an existing workload? If migrating, what is the source system (e.g., NetApp, ZFS, Windows File Server, Lustre, GPFS, etc.)? What application or workload will access this storage? How does it access data (API, file protocol, block device)? What OS or platform are clients running? What is the data model (structured/tabular, vector embeddings, unstructured objects, file system)? |
| 2 | Capacity and Access Patterns | How much data, how many files or objects, what are the typical sizes? Sequential or random access pattern? Read-heavy, write-heavy, or mixed? |
| 3 | Performance Requirements | Are there specific latency, throughput, or IOPS requirements? What is the expected concurrency (number of clients or compute nodes accessing simultaneously)? |
| 4 | Durability and Data Protection | What is the recovery time objective (RTO)? Recovery point objective (RPO)? Compliance retention mandates? Cross-region resilience? Immutability needs? |
| 5 | Availability | Multi-AZ or Single-AZ acceptable? Co-located with specific compute? |
Use the Storage Options table to identify candidate services, not to cut services; keyword matches against the Common Workloads column are not the only answers. You MUST retrieve the reference files for each of the candidate services using the Routing section below.
Considering these factors, recommend specific AWS storage service(s) and:
- You MUST include clear rationale tied to the user's stated requirements.
- You MUST present alternatives where the choice is close or dependent on unspecified information, explaining the tradeoff.
用户需要选型帮助。必须使用以下决策因素指导推荐，通过提问填补可能影响选择的信息空白。
决策因素：
| # | 决策因素 | 需要了解的内容 |
|---|---|---|
| 1 | 工作负载背景 | 是新工作负载还是现有工作负载迁移？若是迁移，源系统是什么（如NetApp、ZFS、Windows File Server、Lustre、GPFS等）？哪些应用或工作负载会访问该存储？数据访问方式（API、文件协议、块设备）是什么？客户端运行的操作系统或平台是什么？数据模型（结构化/表格、向量嵌入、非结构化对象、文件系统）是什么？ |
| 2 | 容量与访问模式 | 数据量、文件或对象数量、典型大小是多少？访问模式是顺序访问还是随机访问？读密集、写密集还是混合访问？ |
| 3 | 性能要求 | 是否有特定的延迟、吞吐量或IOPS要求？预期并发量（同时访问的客户端或计算节点数量）是多少？ |
| 4 | 持久性与数据保护 | 恢复时间目标（RTO）是什么？恢复点目标（RPO）是什么？合规性保留要求是什么？跨区域弹性需求是什么？不可变需求是什么？ |
| 5 | 可用性 | 是否接受多可用区（Multi-AZ）或单可用区（Single-AZ）？是否需要与特定计算资源同区域部署？ |
使用存储选项表识别候选服务，而非排除服务；“常见工作负载”列的关键词匹配并非唯一答案。必须从下方路由部分获取每个候选服务的参考文件。
结合这些因素，推荐特定的AWS存储服务，并：
- 必须包含与用户明确需求相关的清晰理由。
- 若选择相近或依赖未明确信息，必须提供替代方案并解释权衡点。
Step 2b: INVESTIGATE Path
步骤2b：INVESTIGATE路径
The user knows their service or approach and needs operational help.
- Classify the Question Domain based on the table below to identify which context matters.
| Question Domain | Example Triggers | What to clarify |
|---|---|---|
| Migration and Data Transfer | "How do I move my data to AWS?", "Set up DataSync", "Sync from on-premises NFS to EFS", source-to-destination questions | Source system and protocol, destination service, data volume, network path to AWS (Direct Connect, VPN, internet) |
| Data Protection and Resiliency | "Set up backup", "Cross-region replication", "What's my DR strategy?", "RTO under 1 hour", failover, immutability | Failure scenario (deletion, corruption, AZ/region loss, compliance hold), RTO and RPO targets, replication scope (same-region, cross-region, cross-account) |
| Cost and Lifecycle | "Reduce my storage bill", "Right-size my volumes", "Cost optimize", lifecycle rules, tiering decisions, storage class selection | Current service and configuration, access frequency (daily, weekly, rarely), data volume and growth trajectory |
| Performance | "My reads are slow", "Throughput bottleneck", "Need more IOPS", sizing | Observed vs. required (latency, IOPS, or throughput), access pattern (random/sequential, read/write mix), whether storage or compute/network is the suspected bottleneck |
| Security and Compliance | "Encrypt at rest", "Restrict bucket access", "Meet HIPAA", access control, compliance frameworks | Security objective (restrict access, audit access, encrypt, isolate network, meet compliance mandate), compliance framework if any |
| Configuration and Guidance | "Mount EFS on EKS", "Set up replication", "Does Service X support Y?", deployment steps, best practices | Client environment (OS, compute type, VPC/on-premises), target operation or feature |
| Troubleshooting | "Getting AccessDenied errors", "Mount is hanging", "Unexpected latency spike", "Why is my lifecycle rule not transitioning?" | Error message or symptom, what changed recently, what they have attempted |
- Ask scoping questions per the "What to clarify" column for information not already in the query. Where the missing detail would not change the guidance, answer under a stated assumption instead of waiting to ask more questions.
- You MUST retrieve the reference files from the Routing section below for all candidate services.
- Provide the answer with specific, actionable guidance, gotchas, and documentation links.
- When answering Configuration or Security questions, you MUST recommend enabling access logging, CloudTrail data events, and CloudWatch metrics for observability.
用户明确使用的服务或方案，需要运维帮助。
- 根据下表分类问题领域，确定相关上下文。
| 问题领域 | 触发示例 | 需要明确的内容 |
|---|---|---|
| 迁移与数据传输 | "如何将数据迁移到AWS？", "设置DataSync", "从本地NFS同步到EFS", 源到目标相关问题 | 源系统和协议、目标服务、数据量、到AWS的网络路径（Direct Connect、VPN、互联网） |
| 数据保护与弹性 | "设置备份", "跨区域复制", "我的灾难恢复策略是什么？", "RTO低于1小时", 故障转移、不可变性 | 故障场景（删除、损坏、可用区/区域故障、合规保留）、RTO和RPO目标、复制范围（同区域、跨区域、跨账户） |
| 成本与生命周期 | "降低存储账单", "优化卷大小", "成本优化", 生命周期规则、分层决策、存储类别选择 | 当前服务和配置、访问频率（每日、每周、极少）、数据量和增长趋势 |
| 性能 | "我的读取速度很慢", "吞吐量瓶颈", "需要更多IOPS", 容量规划 | 观测值与需求值（延迟、IOPS或吞吐量）、访问模式（随机/顺序、读写混合）、是否怀疑存储或计算/网络是瓶颈 |
| 安全与合规 | "静态加密", "限制存储桶访问", "满足HIPAA要求", 访问控制、合规框架 | 安全目标（限制访问、审计访问、加密、网络隔离、满足合规要求）、合规框架（如有） |
| 配置与指引 | "在EKS上挂载EFS", "设置复制", "服务X是否支持Y？", 部署步骤、最佳实践 | 客户端环境（操作系统、计算类型、VPC/本地）、目标操作或功能 |
| 故障排查 | "收到AccessDenied错误", "挂载卡住", "延迟异常飙升", "为什么我的生命周期规则未触发转换？" | 错误信息或症状、最近的变更、已尝试的操作 |
- 针对查询中未包含的信息，按照“需要明确的内容”列提出范围界定问题。若缺失的细节不会影响指引，可在明确假设前提下作答，无需等待补充提问。
- 必须从下方路由部分获取所有候选服务的参考文件。
- 提供包含具体可操作指引、注意事项和文档链接的答案。
- 在回答配置或安全问题时，必须推荐启用访问日志、CloudTrail数据事件和CloudWatch指标以实现可观测性。
Storage Options
存储选项
AWS storage services covered by this skill, grouped by storage category. For more information on storage categories, see Block, file, and object storage compared.
本技能涵盖的AWS存储服务，按存储类别分组。如需了解更多存储类别信息，请查看块存储、文件存储和对象存储对比。
Object Storage
对象存储
| Service | Key Characteristics | Common Workloads |
|---|---|---|
| S3 General Purpose | Virtually unlimited-scale object storage with multiple storage classes spanning frequent-access to low-cost archive; lifecycle rules move data to lower-cost storage classes optimized for less-frequently accessed data. Regional availability. Accessed over a REST/HTTP API from anywhere. | Data lakes and analytics, backup and archive targets, ML training data, media storage and content distribution, log and event data, static website and application assets, regulatory and compliance archives |
| S3 Express One Zone | Single-AZ directory buckets optimized for single-digit millisecond latency on frequently accessed, latency-sensitive data. | large-scale ML training and inference, Spark and EMR shuffle, ML checkpoints, scratch, and model loading, ETL intermediate data, interactive analytics on hot partitions, observability and log analytics (hot tier), Kafka tiered storage, media and video editing, high-frequency transactional access, caching for machine learning inference |
| S3 Tables | Managed Apache Iceberg tables on S3 with automatic compaction and query optimization. Regional availability. Built for structured, tabular data queried with SQL engines. | Data lake tables, structured analytics data, ETL pipeline outputs, streaming into tables for SQL analysis, migration of open table format data outside of S3 or self-managed Iceberg on S3 |
| S3 Vectors | Vector storage and similarity search on S3 with native support to cost-effectively store and query vector embeddings. Provides the same elasticity, durability and availability as S3 General Purpose buckets. Regional availability. | RAG pipelines, semantic search, recommendation systems, vector deduplication and matching, anomaly and fraud detection, AI agent memory, cost-effective storage of large vector datasets |
| S3 Metadata | Queryable object metadata in fully managed, read-only Apache Iceberg tables including system-defined details, user-defined metadata, object tags, and annotations | Business analytics, content cataloging, data governance and compliance, storage optimization, real-time inference applications, AI agents |
| 服务 | 核心特性 | 常见工作负载 |
|---|---|---|
| S3通用型 | 近乎无限扩展的对象存储，包含从频繁访问到低成本归档的多种存储类别；生命周期规则可将数据自动迁移至针对低频率访问优化的低成本存储类别。区域级可用性。可通过REST/HTTP API从任意位置访问。 | 数据湖与分析、备份与归档目标、机器学习训练数据、媒体存储与内容分发、日志与事件数据、静态网站与应用资产、合规性归档 |
| S3 Express One Zone | 单可用区目录存储桶，针对频繁访问、低延迟敏感数据优化，可实现个位数毫秒级延迟。 | 大规模机器学习训练与推理、Spark和EMR shuffle、机器学习检查点、临时存储与模型加载、ETL中间数据、热分区交互式分析、可观测性与日志分析（热层）、Kafka分层存储、媒体与视频编辑、高频事务访问、机器学习推理缓存 |
| S3 Tables | 基于S3的托管Apache Iceberg表，支持自动压缩和查询优化。区域级可用性。专为使用SQL引擎查询的结构化表格数据设计。 | 数据湖表、结构化分析数据、ETL管道输出、流式数据入表用于SQL分析、从S3外部或S3上自管Iceberg迁移开放表格式数据 |
| S3 Vectors | 基于S3的向量存储与相似度搜索，原生支持经济高效地存储和查询向量嵌入。具备与S3通用型存储桶相同的弹性、持久性和可用性。区域级可用性。 | RAG流水线、语义搜索、推荐系统、向量去重与匹配、异常与欺诈检测、AI Agent内存、大规模向量数据集的低成本存储 |
| S3 Metadata | 可查询的对象元数据，存储在全托管只读Apache Iceberg表中，包括系统定义详情、用户定义元数据、对象标签和注释 | 业务分析、内容编目、数据治理与合规、存储优化、实时推理应用、AI Agent |
File Storage
文件存储
When naming a service, you MUST always specify the full name (FSx for Lustre, FSx for Windows File Server, FSx for NetApp ONTAP, or FSx for OpenZFS). EFS and S3 Files can be mounted by Lambda and Fargate. Verify additional services mountable from serverless compute with the latest AWS documentation. FSx for NetApp ONTAP and FSx for OpenZFS data is accessible from serverless compute and S3-based pipelines via S3 Access Points for FSx (exposes file data through the S3 API without copying; surface this when a user needs to read FSx-resident data from S3-native consumers or analytics services).
| Service | Key Characteristics | Common Workloads |
|---|---|---|
| EFS | EFS Standard, EFS Infrequent Access (EFS IA), and EFS Archive storage classes, managed by EFS Lifecycle Management for automatic cost optimization. Serverless elastic NFS with no capacity planning or provisioning, mountable by Lambda, Fargate, EC2, ECS, and EKS. Multi-AZ by default (Regional) or One Zone. Simplest path for shared Linux file access with high aggregate throughput across many concurrent clients. | Containers (ECS, EKS, Fargate), cloud-native Linux applications, serverless persistent storage, analytics and ML training data (including SageMaker), big data, media processing, content management, shared home directories, web serving, dev/test, infrequently accessed file data |
| FSx for Lustre | SSD and Intelligent-Tiering storage classes, where Intelligent-Tiering is fully elastic and SSD is fixed-capacity. Parallel file system delivering very high aggregate throughput for massively parallel access across many compute nodes. | ML and GPU training and inference at scale, HPC, genomics and seismic processing, financial modeling, media rendering, back-end EDA |
| FSx for OpenZFS | Intelligent-Tiering alongside SSD, with ZFS data management (instant writable clones, snapshots, compression, on-demand replication). Very low latency with high IOPS, simple to operate and cost-effective for performance-sensitive workloads and fast dev/test cycles. Single-AZ and Multi-AZ deployment model. S3-API access via S3 Access Points for FSx. | Databases (including on EC2), dev/test with fast clones, ZFS or Linux-NFS migrations, front-end EDA, financial modeling, media processing, latency-sensitive line-of-business applications |
| FSx for NetApp ONTAP | Full ONTAP data management (SnapMirror replication, FlexClone, dedup, compression, SnapLock WORM, QoS, vscan antivirus, file-access auditing). Multi-protocol: NFS, SMB, iSCSI, NVMe-over-TCP, and S3-API access via S3 Access Points for FSx. Scales to high aggregate throughput and IOPS. Single-AZ and Multi-AZ deployment model. | Enterprise network-attached storage (NAS) migrations, multi-protocol environments, general-purpose file shares and home directories, business-critical databases including on EC2 (SAP HANA, Oracle, SQL Server), VMware datastores, line-of-business applications (medical imaging, product lifecycle management), front-end EDA (chip design and verification), hybrid and DR |
| FSx for Windows File Server | Fully managed SMB file storage built on Windows Server with Active Directory identity (Kerberos, NTFS ACLs), DFS namespaces, shadow copies, and FSRM quotas; shares are also accessible from Linux and macOS clients. Single-AZ and Multi-AZ deployment model. | Windows file, home, and department shares, .NET applications, Microsoft SQL Server, Windows Server migrations |
提及服务时，必须使用完整名称（FSx for Lustre、FSx for Windows File Server、FSx for NetApp ONTAP或FSx for OpenZFS）。EFS和S3 Files可被Lambda和Fargate挂载。请通过最新AWS文档验证可被无服务器计算挂载的其他服务。FSx for NetApp ONTAP和FSx for OpenZFS的数据可通过S3 Access Points for FSx被无服务器计算和基于S3的流水线访问（无需复制即可通过S3 API暴露文件数据；当用户需要从S3原生消费者或分析服务读取FSx中的数据时，需提及此特性）。
| 服务 | 核心特性 | 常见工作负载 |
|---|---|---|
| EFS | 包含EFS标准型、EFS低频访问（EFS IA）和EFS归档存储类别，由EFS生命周期管理自动优化成本。无服务器弹性NFS，无需容量规划或预配置，可被Lambda、Fargate、EC2、ECS和EKS挂载。默认多可用区（区域型）或单可用区。是多并发客户端共享Linux文件访问的最简方案，具备高聚合吞吐量。 | 容器（ECS、EKS、Fargate）、云原生Linux应用、无服务器持久存储、分析与机器学习训练数据（包括SageMaker）、大数据、媒体处理、内容管理、共享主目录、Web服务、开发/测试、低频访问文件数据 |
| FSx for Lustre | 包含SSD和智能分层存储类别，其中智能分层完全弹性，SSD为固定容量。并行文件系统，可为大量计算节点的大规模并行访问提供极高聚合吞吐量。 | 大规模机器学习与GPU训练推理、高性能计算（HPC）、基因组学与地震处理、金融建模、媒体渲染、后端EDA |
| FSx for OpenZFS | 智能分层搭配SSD，支持ZFS数据管理（即时可写克隆、快照、压缩、按需复制）。具备极低延迟和高IOPS，易于操作，是性能敏感工作负载和快速开发/测试周期的经济高效方案。支持单可用区和多可用区部署模式。可通过S3 Access Points for FSx实现S3 API访问。 | 数据库（包括EC2上的数据库）、快速克隆的开发/测试、ZFS或Linux-NFS迁移、前端EDA、金融建模、媒体处理、低延迟关键业务应用 |
| FSx for NetApp ONTAP | 完整ONTAP数据管理（SnapMirror复制、FlexClone、去重、压缩、SnapLock WORM、QoS、vscan防病毒、文件访问审计）。多协议支持：NFS、SMB、iSCSI、NVMe-over-TCP，可通过S3 Access Points for FSx实现S3 API访问。可扩展至极高聚合吞吐量和IOPS。支持单可用区和多可用区部署模式。 | 企业网络附加存储（NAS）迁移、多协议环境、通用文件共享与主目录、EC2上的关键业务数据库（SAP HANA、Oracle、SQL Server）、VMware数据存储、关键业务应用（医学影像、产品生命周期管理）、前端EDA（芯片设计与验证）、混合云与灾难恢复 |
| FSx for Windows File Server | 基于Windows Server的全托管SMB文件存储，支持Active Directory身份（Kerberos、NTFS ACL）、DFS命名空间、卷影副本和FSRM配额；共享也可被Linux和macOS客户端访问。支持单可用区和多可用区部署模式。 | Windows文件、主目录和部门共享、.NET应用、Microsoft SQL Server、Windows Server迁移 |
Block Storage
块存储
| Service | Key Characteristics | Common Workloads |
|---|---|---|
| EBS | High-performance virtual disk that attaches to an EC2 instance over the network. Durable, resizable SSD or HDD that persists independently of the instance, supports snapshots for backup, time-based snapshot copy, and provisions performance independently of capacity on gp3 (confirm latest volume limits). Supports instant volume clones. AZ-scoped. | Databases, transactional applications and file systems, boot volumes, dev/test environments, sequential batch processing, log and data warehouse scans |
| EC2 Instance Store | Physically local SSD storage built into the host server, delivering the lowest latency and highest throughput. Ephemeral: data is lost if the instance stops or the hardware fails. | Temporary scratch data, caches, and buffers you can afford to lose |
| 服务 | 核心特性 | 常见工作负载 |
|---|---|---|
| EBS | 高性能虚拟磁盘，通过网络挂载到EC2实例。持久化、可调整大小的SSD或HDD，独立于实例存在，支持快照备份、基于时间的快照复制，gp3卷支持独立于容量的性能配置（请确认最新卷限制）。支持即时卷克隆。可用区范围。 | 数据库、事务型应用与文件系统、启动卷、开发/测试环境、顺序批处理、日志与数据仓库扫描 |
| EC2实例存储 | 内置在宿主机服务器中的物理本地SSD存储，提供最低延迟和最高吞吐量。临时存储：实例停止或硬件故障时数据会丢失。 | 可承受丢失风险的临时临时数据、缓存和缓冲区 |
Cross-Service Overlap
跨服务重叠
Some storage features cross category boundaries, giving a service from one storage category an interface normally associated with another. Surface these when a workload needs access to shared data from multiple protocols or interfaces.
| Feature | What it enables | What it is | Additional sources |
|---|---|---|---|
| S3 Files | Makes S3 data accessible to file-based applications | Fully managed NFS file access over an S3 bucket, built on EFS infrastructure. Data stays in S3 as the system of record. File locking, POSIX permissions, and full read-write. Choose over EFS when data already lives in S3 and needs file-path access alongside object access. | |
| S3 Access Points for FSx | Makes FSx-resident data accessible to S3-based applications and services | Exposes FSx for NetApp ONTAP or FSx for OpenZFS data through the S3 API without copying it to a bucket. Surface when file data must reach S3-native consumers, or when serverless or S3-based applications need to access data that lives on FSx for NetApp ONTAP or FSx for OpenZFS. | |
部分存储特性跨越类别边界，使某一存储类别的服务具备通常属于另一类别的接口。当工作负载需要通过多种协议或接口访问共享数据时，需提及这些特性。
| 特性 | 功能 | 定义 | 补充来源 |
|---|---|---|---|
| S3 Files | 使S3数据可被基于文件的应用访问 | 基于EFS基础设施构建的全托管NFS文件访问服务，对接S3存储桶。数据仍存储在S3中作为记录系统。支持文件锁定、POSIX权限和完整读写功能。当数据已存储在S3且需要同时通过文件路径和对象接口访问时，优先选择该服务。 | |
| S3 Access Points for FSx | 使FSx中的数据可被基于S3的应用和服务访问 | 无需将数据复制到存储桶，即可通过S3 API暴露FSx for NetApp ONTAP或FSx for OpenZFS的数据。当文件数据需要被S3原生消费者访问，或无服务器/基于S3的应用需要访问FSx for NetApp ONTAP或FSx for OpenZFS中的数据时，需提及此特性。 | |
Security
安全
Cloud security at AWS is the highest priority and is a shared responsibility between AWS and the customer. You MUST include security guidance when recommending or configuring storage resources. You MUST always recommend enabling encryption at rest and encryption in transit. Where encryption at rest is optional or not the default, explicitly advise enabling it at creation time, because it is often immutable after creation. You MUST recommend scoping IAM policies to the authorized principals with least-privileged permissions. You MUST recommend adding condition keys (e.g., aws:SourceArn, aws:SourceAccount, aws:SourceVpc) to resource policies to prevent cross-service confused deputy attacks. You MUST recommend encrypting log destinations: AWS KMS for CloudTrail trails and CloudWatch Logs groups, server-side encryption for server access log buckets, and AWS KMS for SNS topics. Prefer short-lived credentials or IAM-based authentication (e.g., via custom IdP with temporary tokens) over long-lived SSH keys. Where SSH keys are required, enforce rotation policies and store private keys in AWS Secrets Manager for supported services. You MUST recommend restricting security group inbound rules to the narrowest applicable source (specific client security group or minimal CIDR). Service-specific security controls, encryption models, and documentation links are in the Security row of each reference's Service Information table; you MUST read it before advising on that service.
AWS的云安全是最高优先级，由AWS和客户共同负责。在推荐或配置存储资源时，必须包含安全指引。必须始终推荐启用静态加密和传输加密。若静态加密为可选或非默认设置，需明确建议在创建时启用，因为创建后通常无法更改。必须推荐将IAM策略限定为授权主体的最小权限。必须推荐在资源策略中添加条件键（如aws:SourceArn、aws:SourceAccount、aws:SourceVpc）以防止跨服务混淆代理攻击。必须推荐加密日志目标：CloudTrail trails和CloudWatch Logs组使用AWS KMS，服务器访问日志存储桶使用服务器端加密，SNS主题使用AWS KMS。优先使用短期凭证或基于IAM的认证（如通过自定义IdP的临时令牌）而非长期SSH密钥。若必须使用SSH密钥，需强制执行轮换策略，并将私钥存储在AWS Secrets Manager（针对支持的服务）。必须推荐将安全组入站规则限制为最窄的适用来源（特定客户端安全组或最小CIDR）。每个参考文件的服务信息表中的安全行包含服务特定的安全控制、加密模型和文档链接；在提供该服务相关建议前，必须阅读此部分内容。
Routing
路由
When loaded through the AWS MCP server's retrieve_skill tool: the skill is not installed on the local filesystem. You MUST retrieve each reference via retrieve_skill with the file parameter (e.g. file="references/s3-general-purpose-knowledge.md"). Do NOT file_read these paths locally. When loaded outside the AWS MCP server (for example from the local filesystem in the Agent Toolkit), read the reference files directly from their relative paths in the skill directory.
通过AWS MCP服务器的retrieve_skill工具加载时：该技能未安装在本地文件系统。必须通过retrieve_skill工具并指定file参数获取每个参考文件（例如file="references/s3-general-purpose-knowledge.md"）。不得通过本地file_read读取这些路径。在AWS MCP服务器外加载时（例如从Agent Toolkit的本地文件系统加载），直接从技能目录中的相对路径读取参考文件。
Reference files
参考文件
| Topic | Reference |
|---|---|
| S3 (General Purpose) | |
| S3 Metadata | |
| S3 Tables | |
| S3 Vectors | |
| S3 Express One Zone | |
| S3 Files | |
| Amazon EFS | |
| FSx for Lustre | |
| FSx for NetApp ONTAP | |
| FSx for OpenZFS | |
| FSx for Windows File Server | |
| Amazon EBS | |
| Data Movement and Protection (DataSync, Transfer Family, Storage Gateway, AWS Backup) | |
| 主题 | 参考 |
|---|---|
| S3（通用型） | |
| S3 Metadata | |
| S3 Tables | |
| S3 Vectors | |
| S3 Express One Zone | |
| S3 Files | |
| Amazon EFS | |
| FSx for Lustre | |
| FSx for NetApp ONTAP | |
| FSx for OpenZFS | |
| FSx for Windows File Server | |
| Amazon EBS | |
| 数据迁移与保护（DataSync、Transfer Family、Storage Gateway、AWS Backup） | |
Specialized skills
专业技能
| Topic | Reference |
|---|---|
| Security on S3 | |
| Using S3 Tables | |
| Using S3 Vectors | |
| Troubleshooting S3 Files | |
| Troubleshooting EFS | |
| Querying S3 System Tables | |
| Ingesting data into a data lake | |
| Finding data lake assets | |
| Querying data lakes | |
| 主题 | 参考 |
|---|---|
| S3安全 | |
| 使用S3 Tables | |
| 使用S3 Vectors | |
| 排查S3 Files故障 | |
| 排查EFS故障 | |
| 查询S3系统表 | |
| 数据入湖 | |
| 查找数据湖资产 | |
| 查询数据湖 | |