S3 survives losing a whole zone, without three copies

transcript

A whole AWS zone loses power. S3 loses nothing. And it doesn't keep three copies of your file.

S3 holds about 250 exabytes of customer data. The obvious protection: three full copies. That's about 750 exabytes of disk. S3's way needs about 400. Hundreds of exabytes of drives saved.

Take a 1 megabyte object. Cut it into 10 data shards. Compute 6 parity shards from them. 16 in all, about 100 kilobytes each. Here's the magic. Any 10 of the 16 rebuild the object. Spread them: 6 in one zone, 5 and 5 in the others.

Why never more than 6 in one zone? Because 6 is the parity budget. Lose the biggest zone, and 10 shards remain. Still readable.

On a read, S3 counts shards that pass their checksum. All 16? Serve it. 10 to 15? Decode, serve, and queue the rest for repair. But here's the catch. A zone down, plus one more drive? Only 9 left. Unreadable. So the race is on.

Repair starts at once, in parallel, across thousands of drives. Repair queue over a million objects? Critical alert. Because repair speed is durability.

Full breakdown in the lecture.