Prerequisites
Progress checklist
Overview
Section titled “Overview”Finish Install tooling first. This page covers the AWS account shape and Express constraints before you create resources.
This lab creates billable resources: a dedicated VPC, two S3 buckets (Standard +
directory-bucket
S3 bucket type that hosts the S3 Express One Zone storage class. Names follow bucket-base-name--zone-id--x-s3 and live in a single Availability Zone.), an IAM role/instance profile, and an
m7g.large EC2 instance running the harness
Docker container on the lab EC2 instance that continuously GETs the same keys from Express and Standard, exposes a dashboard on :8080, and reports p50/p90 latency ratios..
What you need
Section titled “What you need”| Piece | Notes |
|---|---|
| Tooling | AWS CLI ≥ 2.15.0 (latest fine), jq — see Install tooling |
| AWS account | Operator credentials with permission to create VPC, endpoints, buckets, IAM, and EC2 |
| Named profile | AWS_PROFILE=sandbox — demo.sh refuses an implicit account |
| Region | Lab Region is ap-southeast-2 |
| Express AZ | Only apse2-az1 Availability Zone ID — a unique, account-stable identifier such as apse2-az1. Directory bucket names and Express location config use the AZ ID, not the account-local AZ name (for example ap-southeast-2a). in Sydney — place subnet + EC2 there |
Hard requirements
Section titled “Hard requirements”- Directory buckets need both gateway endpoints:
com.amazonaws.ap-southeast-2.s3andcom.amazonaws.ap-southeast-2.s3express. - Co-locate compute with the Express AZ ID. Crossing AZs adds latency and defeats the bakeoff.
- Zonal object operations need CreateSession
s3express:CreateSession — session-based auth for zonal (object-level) operations on a directory bucket. The SDK or CLI obtains temporary credentials scoped to that bucket before GET/PUT/LIST. on the instance role.
Environment check
Section titled “Environment check”export AWS_PROFILE=sandboxexport AWS_REGION=ap-southeast-2aws sts get-caller-identityaws --version# expect aws-cli/2.15.0 or newer (latest fine)Looks like (placeholder account):
{ "UserId": "AROAEXAMPLE:session-name", "Account": "123456789012", "Arn": "arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_…/you"}Continue to Architecture, then the CLI overview.