S3 Object Storage

An S3 bucket is a container for objects (files). Bucket names must be globally unique across all AWS accounts, lowercase, 3-63 characters, no periods in us-east-1. Each bucket belongs to one AWS account in one region.

Versioning preserves, retrieves, and restores every version of every object. Enable versioning to protect against accidental deletions (DELETE puts a delete marker) and overwrites. Versioning is required for cross-region replication. Once enabled, versioning can only be suspended, not removed.

Bucket policies use resource-based JSON to grant cross-account access or enforce encryption. Example: require all uploads use server-side encryption. Bucket ACLs provide simpler access control but are less recommended—use bucket policies or IAM instead. Access Points simplify access management for shared datasets—create named endpoints with different policies for different applications.

S3 offers six storage classes optimized for different access patterns:

S3 Standard for frequently accessed data—99.999999999% durability, low latency, no retrieval fees. S3 Standard-IA (Infrequent Access) for data accessed monthly—30% cheaper storage but retrieval charges apply. S3 One Zone-IA for non-critical, re-creatable data at 50% less cost.

S3 Glacier Instant Retrieval for data accessed quarterly—millisecond retrieval, lowest archive cost. S3 Glacier Flexible Retrieval for archives accessed 1-2 times yearly—free bulk retrieval in 12 hours, expedited in 1-5 minutes. S3 Glacier Deep Archive for long-term retention (7-10 years)—cheapest option, 12-48 hour retrieval.

S3 Intelligent-Tiering automatically moves objects between tiers based on access patterns—no retrieval fees, small monitoring fee per object. Ideal for unknown or changing access patterns. Choose based on retrieval time tolerance and data access frequency.

Cross-Region Replication (CRR) copies objects to a bucket in another region for compliance, latency reduction, or disaster recovery. Enable versioning on both source and destination. Replication Time Control (RTC) guarantees 15-minute replication for 99.99% of objects.

Same-Region Replication (SRR) copies objects within the same region—useful for log aggregation, dev/test from production, and customer-facing data sovereignty requirements.

S3 Event Notifications trigger Lambda functions, SNS topics, or SQS queues on object events: s3:ObjectCreated:*, s3:ObjectRemoved:*. Filter by prefix (folder) or suffix (file type). Use S3 Event Notifications with EventBridge for more complex routing and filtering patterns.

Replication metrics in CloudWatch track replication lag and bytes pending. Monitor to ensure SLAs are met. Replication rules can be configured to replicate entire bucket or specific prefixes.

Server-Side Encryption (SSE) protects data at rest: SSE-S3 (S3 manages keys), SSE-KMS (AWS KMS manages keys with audit trail), SSE-C (you provide keys). Default encryption applies to all new objects.

Block Public Access settings prevent accidental public exposure—enable at account and bucket level. Use VPC Endpoints to access S3 without internet gateway. Bucket policies can enforce aws:SecureTransport (HTTPS-only) and s3:signatureversion (SigV4).

Pre-signed URLs provide temporary access to private objects—generate with SDK, valid for specified duration (default 15 min). Use for file uploads/downloads without exposing bucket publicly. Pre-signed URLs use your IAM credentials for authorization.

Access Points simplify managing access to shared datasets—create named endpoints with custom policies. Useful for restricting access to specific VPCs or applications. S3 Access Grants integrate with corporate identity providers for fine-grained access.