Amazon S3 – Object Storage

Amazon S3 is one of the main building blocks of AWS. It is advertised as “infinitely scaling” storage, many websites use it as a backbone, and many AWS services integrate with it. This chapter takes the step-by-step approach the deck uses: buckets, objects, security, websites, versioning, replication, storage classes, encryption, and finally the hybrid story (Snowball and Storage Gateway).

1. Use cases

S3 shows up almost everywhere, and the deck lists the classic uses:

• Backup and storage
• Disaster Recovery
• Archive
• Hybrid Cloud storage
• Application hosting
• Media hosting
• Data lakes & big data analytics
• Software delivery
• Static website

Two customer examples from the slide: Nasdaq stores 7 years of data into S3 Glacier, and Sysco runs analytics on its data stored in S3 to gain business insights.

2. Buckets

Amazon S3 lets you store objects (files) in buckets (directories).

• Buckets must have a globally unique name — across all Regions and all accounts.
• Buckets are defined at the Region level. S3 looks like a global service, but every bucket is created in a Region.

The naming convention is strict and the exam likes to test it:

• No uppercase, no underscore
• 3–63 characters long
• Not an IP address
• Must start with a lowercase letter or a number
• Must NOT start with the prefix xn--
• Must NOT end with the suffix -s3alias

Exam tip

“Globally unique name” and “defined at the Region level” are not a contradiction — the namespace is global, the data lives in one Region. If a question says two accounts both want the bucket name my-data, only one of them can have it.

3. Objects

Objects (files) have a Key. The key is the FULL path of the object:

s3://my-bucket/my_file.txt
s3://my-bucket/my_folder1/another_folder/my_file.txt

The key is composed of a prefix plus the object name. In the second example the prefix is my_folder1/another_folder/ and the object name is my_file.txt.

There is no concept of “directories” within buckets, even though the console UI will trick you into thinking otherwise. There are just keys with very long names that happen to contain slashes.

An object also carries:

• Value — the content of the body. Max object size is 5 TB (5000 GB). If you upload more than 5 GB, you must use multi-part upload.
• Metadata — a list of text key/value pairs, system or user metadata.
• Tags — Unicode key/value pairs, up to 10 — useful for security and lifecycle rules.
• Version ID — if versioning is enabled.

Exam tip

Two numbers that get confused: 5 TB is the maximum object size; 5 GB is the threshold above which multi-part upload becomes mandatory.

4. S3 security

Access to S3 comes from two directions.

User-based:

• IAM Policies — which API calls are allowed for a specific user from IAM.

Resource-based:

• Bucket Policies — bucket-wide rules set from the S3 console; these allow cross-account access.
• Object Access Control List (ACL) — finer grain, can be disabled.
• Bucket Access Control List (ACL) — less common, can be disabled.

The evaluation rule the deck states: an IAM principal can access an S3 object if the user’s IAM permissions ALLOW it OR the resource policy ALLOWS it, AND there is no explicit DENY.

On top of that, encryption lets you encrypt objects in Amazon S3 using encryption keys.

S3 Bucket Policies

Bucket policies are JSON based and made of:

• Resources — buckets and objects
• Effect — Allow / Deny
• Actions — the set of APIs to allow or deny
• Principal — the account or user the policy applies to

Use an S3 bucket policy to:

• Grant public access to the bucket
• Force objects to be encrypted at upload
• Grant access to another account (cross-account)

The deck walks four access patterns:

Scenario	Mechanism
Anonymous website visitor reading the bucket	S3 Bucket Policy allowing public access
An IAM user in your own account	IAM Policy attached to the user
An EC2 instance reading the bucket	EC2 Instance Role with IAM permissions
A user in another AWS account	S3 Bucket Policy allowing cross-account

Real-world example

An application running on EC2 that needs to read files from S3 should get an EC2 instance role, not an access key baked into the AMI. The role gives the instance temporary credentials and nothing has to be rotated by hand.

Block Public Access

The Block Public Access bucket settings were created to prevent company data leaks. If you know your bucket should never be public, leave them on. They can also be set at the account level, which blankets every bucket you own.

5. Static website hosting

S3 can host static websites and make them accessible on the Internet. Depending on the Region, the website URL will be one of:

http://bucket-name.s3-website-aws-region.amazonaws.com
http://bucket-name.s3-website.aws-region.amazonaws.com

Exam tip

If you get a 403 Forbidden error on an S3 static website, the fix is to make sure the bucket policy allows public reads. This is a recurring exam question.

6. Versioning

You can version your files in Amazon S3.

• It is enabled at the bucket level.
• Overwriting the same key changes the “version”: 1, 2, 3…
• It is best practice to version your buckets: it protects against unintended deletes (you can restore a version) and makes rolling back to a previous version easy.

Two notes the exam likes:

• Any file that was not versioned prior to enabling versioning will have version “null”.
• Suspending versioning does not delete the previous versions.

7. Replication (CRR & SRR)

S3 Replication copies objects from one bucket to another.

• You must enable Versioning in both the source and the destination buckets.
• Cross-Region Replication (CRR) and Same-Region Replication (SRR) are both available.
• Buckets can be in different AWS accounts.
• Copying is asynchronous.
• You must give proper IAM permissions to S3.

Use cases:

• CRR — compliance, lower latency access, replication across accounts.
• SRR — log aggregation, live replication between production and test accounts.

Exam tip

“Replication fails / nothing is copied” almost always maps back to one of two causes on the exam: versioning is not enabled on both sides, or S3 was not given the IAM permissions to replicate.

8. Storage classes

The classes available are:

• Amazon S3 Standard – General Purpose
• Amazon S3 Standard-Infrequent Access (IA)
• Amazon S3 One Zone-Infrequent Access
• Amazon S3 Glacier Instant Retrieval
• Amazon S3 Glacier Flexible Retrieval
• Amazon S3 Glacier Deep Archive
• Amazon S3 Intelligent-Tiering

You can move objects between classes manually or using S3 Lifecycle configurations.

Durability and availability

• Durability: high durability of 99.999999999% (11 nines) of objects across multiple AZ. If you store 10,000,000 objects in S3, you can on average expect to lose a single object once every 10,000 years. This is the same for all storage classes.
• Availability: measures how readily available a service is, and it varies depending on the storage class. S3 Standard has 99.99% availability — that is 53 minutes of unavailability a year.

S3 Standard – General Purpose

• 99.99% availability
• For frequently accessed data
• Low latency and high throughput
• Sustains 2 concurrent facility failures
• Use cases: big data analytics, mobile & gaming applications, content distribution

Infrequent Access classes

For data that is less frequently accessed but requires rapid access when needed, at a lower cost than S3 Standard.

• S3 Standard-IA — 99.9% availability. Use cases: disaster recovery, backups.
• S3 One Zone-IA — high durability (99.999999999%) but in a single AZ; data is lost when the AZ is destroyed. 99.5% availability. Use cases: storing secondary backup copies of on-premises data, or data you can recreate.

Glacier classes

Low-cost object storage meant for archiving / backup. Pricing is storage + object retrieval cost.

• S3 Glacier Instant Retrieval — millisecond retrieval, great for data accessed once a quarter. Minimum storage duration 90 days.
• S3 Glacier Flexible Retrieval (formerly Amazon S3 Glacier) — Expedited (1 to 5 minutes), Standard (3 to 5 hours), Bulk (5 to 12 hours — free). Minimum storage duration 90 days.
• S3 Glacier Deep Archive — for long-term storage. Standard (12 hours), Bulk (48 hours). Minimum storage duration 180 days.

S3 Intelligent-Tiering

• Small monthly monitoring and auto-tiering fee
• Moves objects automatically between access tiers based on usage
• No retrieval charges in S3 Intelligent-Tiering

The tiers:

• Frequent Access tier (automatic) — the default tier
• Infrequent Access tier (automatic) — objects not accessed for 30 days
• Archive Instant Access tier (automatic) — objects not accessed for 90 days
• Archive Access tier (optional) — configurable from 90 days to 700+ days
• Deep Archive Access tier (optional) — configurable from 180 days to 700+ days

Comparison table

	Standard	Intelligent-Tiering	Standard-IA	One Zone-IA	Glacier Instant Retrieval	Glacier Flexible Retrieval	Glacier Deep Archive
Durability	11 nines	11 nines	11 nines	11 nines	11 nines	11 nines	11 nines
Availability	99.99%	99.9%	99.9%	99.5%	99.9%	99.99%	99.99%
Availability SLA	99.9%	99%	99%	99%	99%	99.9%	99.9%
Availability Zones	>= 3	>= 3	>= 3	1	>= 3	>= 3	>= 3
Min. storage duration charge	None	None	30 days	30 days	90 days	90 days	180 days
Min. billable object size	None	None	128 KB	128 KB	128 KB	40 KB	40 KB
Retrieval fee	None	None	Per GB retrieved	Per GB retrieved	Per GB retrieved	Per GB retrieved	Per GB retrieved

Storage cost per GB per month in us-east-1, for a sense of the gradient: Standard $0.023, Intelligent-Tiering $0.0025 – $0.023, Standard-IA $0.0125, One Zone-IA $0.01, Glacier Instant Retrieval $0.004, Glacier Flexible Retrieval $0.0036, Glacier Deep Archive $0.00099. Intelligent-Tiering adds a monitoring cost of $0.0025 per 1000 objects.

Real-world example

A media company keeps the current month’s uploads in S3 Standard, lifecycles them to Standard-IA after 30 days, then to Glacier Deep Archive after a year for the legal retention window — roughly a 23x drop in storage price for the archived tail.

9. S3 Express One Zone

A high performance, single Availability Zone storage class.

• Objects are stored in a Directory Bucket (a bucket in a single AZ)
• Handles 100,000s of requests per second with single-digit millisecond latency
• Up to 10x better performance than S3 Standard at 50% lower costs
• High durability (99.999999999%) and availability (99.95%)
• Co-locate your storage and compute resources in the same AZ to reduce latency
• Use cases: latency-sensitive apps, data-intensive apps, AI & ML training, financial modeling, media processing, HPC
• Best integrated with SageMaker Model Training, Athena, EMR, Glue

10. Encryption

Two ways to encrypt objects in S3:

• Server-Side Encryption (default) — the user uploads the file and the server encrypts the file after receiving it.
• Client-Side Encryption — the user encrypts the file before uploading it.

11. IAM Access Analyzer for S3

IAM Access Analyzer for S3 ensures that only the intended people have access to your S3 buckets — for example flagging a publicly accessible bucket, or a bucket shared with another AWS account. It evaluates S3 Bucket Policies, S3 ACLs and S3 Access Point Policies, and is powered by IAM Access Analyzer.

12. Shared Responsibility Model for S3

AWS is responsible for	You are responsible for
Infrastructure (global security, durability, availability, sustaining concurrent loss of data in two facilities)	S3 Versioning
Configuration and vulnerability analysis	S3 Bucket Policies
Compliance validation	S3 Replication setup
	Logging and monitoring
	S3 Storage Classes
	Data encryption at rest and in transit

13. AWS Snowball

AWS Snowball provides highly-secure, portable devices to collect and process data at the edge, and to migrate data into and out of AWS. It helps migrate up to Petabytes of data.

Snowball Edge device	Compute	Memory	Storage (SSD)
Snowball Edge Storage Optimized	104 vCPUs	416 GB	210 TB
Snowball Edge Compute Optimized	104 vCPUs	416 GB	28 TB

Why offline migration

Transferring large datasets over the network is slow:

	100 Mbps	1 Gbps	10 Gbps
10 TB	12 days	30 hours	3 hours
100 TB	124 days	12 days	30 hours
1 PB	3 years	124 days	12 days

The challenges the deck lists: limited connectivity, limited bandwidth, high network cost, shared bandwidth (you can’t maximise the line), and connection stability.

Exam tip

The rule of thumb straight off the slide: if it takes more than a week to transfer over the network, use Snowball devices.

Edge computing

Edge computing means processing data while it is being created at an edge location — a truck on the road, a ship at sea, a mining station underground. These locations may have limited internet and no access to computing power. You set up a Snowball Edge device to do edge computing there:

• Snowball Edge Compute Optimized (dedicated for that use case) and Storage Optimized
• Run EC2 instances or Lambda functions at the edge
• Use cases: preprocess data, machine learning, transcoding media

Snowball Edge pricing

• You pay for device usage and data transfer out of AWS. Data transfer IN to Amazon S3 is $0.00 per GB.
• On-Demand — includes a one-time service fee per job covering 10 days of usage for Snowball Edge Storage Optimized 80TB, or 15 days for Snowball Edge Storage Optimized 210TB. Shipping days are NOT counted towards the included 10 or 15 days; you pay per day for any additional days.
• Committed Upfront — pay in advance for monthly, 1-year and 3-year usage (edge computing), with up to 62% discounted pricing.

14. Hybrid cloud for storage and Storage Gateway

AWS is pushing for hybrid cloud: part of your infrastructure on-premises, part of it in the cloud. That can be due to long cloud migrations, security requirements, compliance requirements, or IT strategy.

S3 is a proprietary storage technology (unlike EFS / NFS), so how do you expose S3 data on-premises? AWS Storage Gateway.

The cloud-native storage options group into three shapes:

• Block — Amazon EBS, EC2 Instance Store
• File — Amazon EFS
• Object — Amazon S3, S3 Glacier

AWS Storage Gateway is the bridge between on-premises data and cloud data in S3 — a hybrid storage service that lets on-premises systems seamlessly use the AWS Cloud. Use cases: disaster recovery, backup & restore, tiered storage. The types are File Gateway, Volume Gateway and Tape Gateway — the deck notes you do not need to know the types at the exam.

Real-world example

A company keeps its backup software on-premises writing to virtual tapes. A Tape Gateway presents those tapes to the existing software while the data actually lands in S3 and Glacier — no change to the backup process, no tape library to maintain.

Quick recap

Concept	What to remember for the exam
Buckets vs objects	Globally unique bucket name, but the bucket is tied to a Region; objects are keys, not directories
Object limits	Max 5 TB per object; multi-part upload required above 5 GB; up to 10 tags
Security	IAM policies (user-based) + bucket policies / ACLs (resource-based); allow from either, no explicit deny
Block Public Access	Anti-data-leak setting, can be applied account-wide
Static website	403 Forbidden → the bucket policy does not allow public reads
Versioning	Enabled at the bucket level; pre-existing files get version “null”; suspending does not delete versions
Replication	CRR and SRR, asynchronous, versioning required on both buckets, IAM permissions for S3
Durability	99.999999999% (11 nines) for every storage class; availability is what varies
Standard-IA vs One Zone-IA	One Zone-IA is a single AZ — data is lost if the AZ is destroyed
Glacier minimums	Instant Retrieval and Flexible Retrieval 90 days, Deep Archive 180 days
Intelligent-Tiering	Auto-moves objects between tiers for a monitoring fee, no retrieval charges
S3 Express One Zone	Directory Bucket in one AZ, 10x faster than Standard, for latency-sensitive workloads
Encryption	Server-side (default, encrypted after arrival) vs client-side (encrypted before upload)
Snowball	Physical device for petabyte migrations; use it when the network transfer would take over a week; also runs EC2/Lambda at the edge
Storage Gateway	Hybrid bridge extending on-premises storage into S3; File / Volume / Tape types not examined