Amazon S3

S3 (Simple Storage Service) is AWS object storage. You store files — called objects — inside containers called buckets. No capacity to provision, no filesystem to manage. Virtually unlimited scale with 11 nines of durability.

Objects and Keys

An object is any file. The key is its full path inside the bucket — including what looks like folder names (they are just slashes in the key, not real directories).

Storage Classes — Automatic Cost Optimisation

Lifecycle rules automate transitions: Standard → Standard-IA after 30 days → Glacier after 90 days → expire after 365 days.

Access Control — The Decision Rule

A request to S3 is allowed if: (IAM policy allows it) OR (Bucket policy allows it) AND (no explicit Deny anywhere).

An explicit Deny always wins — over any Allow, in any policy, anywhere.

Block Public Access

Four settings that override bucket policies and ACLs trying to make buckets public. All four are ON by default for every new bucket. This is the safety net that prevents accidental data exposure.

Only disable Block Public Access when you specifically need a public bucket (static website, public downloads). Every other bucket should have all four settings on.

Versioning

Performance

Encryption

Remember

Bucket names are globally unique across all AWS accounts worldwide. A name used by anyone is unavailable to everyone else. Use a pattern like company-project-environment-accountid to avoid conflicts.

Common Mistake

Setting the S3 server access log destination to the same bucket being logged. Every access creates a log → which is an access → which creates another log → bucket grows uncontrollably. Always use a separate dedicated logging bucket.