Amazon S3 – Object Storage

1. What Amazon S3 is

Amazon S3 is one of the main building blocks of AWS. It is advertised as “infinitely scaling” storage, which in practice means you keep pushing data in without provisioning capacity, growing a disk, or ordering hardware ahead of time.

Two facts explain why S3 shows up everywhere. First, many websites use Amazon S3 as their backbone for storage. Second, many AWS services integrate with S3 as a source or a destination, so almost no AWS architecture avoids it entirely. That is why the course takes a step-by-step approach to S3: this chapter is the foundation, followed by S3 advanced features and S3 security.

The list of use cases shows S3 is far more than “a place to put files”:

• Backup and storage — general-purpose backups.
• Disaster recovery — a copy of your data that survives a regional problem.
• Archive — long-term retention.
• Hybrid cloud storage — the cloud half of an on-premises plus cloud setup.
• Application hosting and media hosting.
• Data lakes and big data analytics — S3 is where analytics data lands.
• Software delivery — shipping installers and packages.
• Static website hosting.

Two customer examples from the deck make it concrete: Nasdaq stores 7 years of data in S3 Glacier, and Sysco runs analytics on its data in S3 to gain business insights. The first is pure archival, the second is a data lake — same service, opposite access patterns.

2. S3 Buckets

Amazon S3 lets you store objects (files) inside buckets (directories). The bucket is the top-level container, and it comes with two rules that the exam likes.

• A bucket name must be globally unique across all regions and all accounts. If somebody else already took the name, you cannot have it, even in a different region of your own account.
• Buckets are defined at the region level. S3 looks like a global service in the console, but each bucket lives in one region and your data physically sits there.

The naming convention is strict:

• Lowercase only — uppercase letters and the underscore character are both rejected.
• Length has to land between 3 and 63 characters.
• The name cannot be formatted like an IP address.
• The first character has to be either a lowercase letter or a digit.
• xn-- is a forbidden prefix.
• -s3alias is a forbidden suffix.

Exam tip

Hold both halves of the statement at once: the name is global, the bucket is regional. A question that says “the bucket name is already in use in another account” is describing expected behavior, not a bug. And a question about data residency is answered by the bucket’s region, not by the name.

3. S3 Objects

Every object has a key, and the key is the full path of the object inside the bucket:

s3://my-bucket/my_file.txt
s3://my-bucket/my_folder1/another_folder/my_file.txt

The key is made of a prefix plus the object name. In the second example the prefix is my_folder1/another_folder/ and the object name is my_file.txt.

There is no concept of directories inside a bucket, even though the console’s folder view will trick you into believing there is. What actually exists is a flat set of keys, some of which happen to contain slashes.

The object’s value is the content of its body, and it comes with several properties:

• Maximum object size is 5 TB (5000 GB).
• If you upload more than 5 GB, you must use multi-part upload.
• Metadata — a list of text key/value pairs, either system metadata or your own user metadata.
• Tags — Unicode key/value pairs, up to 10 per object, useful for security rules and lifecycle rules.
• Version ID, if versioning is enabled on the bucket.

Exam tip

Two numbers are commonly swapped in questions: 5 TB is the object size ceiling, 5 GB is the point at which multi-part upload becomes mandatory. Tags max out at 10 per object.

4. Security in S3

S3 access control comes in two families, and the exam expects you to know when each one applies.

User-based:

• IAM policies decide which API calls a specific IAM user or role is allowed to make.

Resource-based:

• Bucket policies are bucket-wide JSON rules attached from the S3 console. They are the mechanism that allows cross-account access.
• Object Access Control Lists (ACLs) give finer-grained, per-object control, and can be disabled.
• Bucket ACLs are less common, and can also be disabled.

The evaluation rule ties them together. An IAM principal can access an S3 object if:

• the user’s IAM permissions allow it OR the resource policy allows it,
• AND there is no explicit DENY.

On top of access control there is encryption: objects in S3 can be encrypted with encryption keys, which is the subject of the S3 security chapter.

S3 bucket policies

Bucket policies are JSON documents with the familiar building blocks:

• Resources — the buckets and objects the statement applies to.
• Effect — Allow or Deny.
• Actions — the set of APIs being allowed or denied.
• Principal — the account or user the policy applies to.

You reach for a bucket policy when you want to:

• grant public access to the bucket,
• force objects to be encrypted at upload,
• grant access to another AWS account (cross-account).

Which mechanism for which scenario

The deck walks through four small architectures, and they map cleanly onto exam answers.

Scenario	Mechanism
An anonymous website visitor reads objects	S3 bucket policy allowing public access
An IAM user in your own account accesses the bucket	IAM policy attached to that user
An EC2 instance accesses the bucket	EC2 instance role carrying the IAM permissions
An IAM user in another AWS account accesses the bucket	S3 bucket policy allowing cross-account access

Exam tip

The dividing line is whose account the caller lives in. Inside your account: attach an IAM policy (and for compute, use a role). Outside your account, or anonymous: use a bucket policy.

Block Public Access

The bucket also carries a set of Block Public Access settings. They exist for one reason: to prevent company data leaks, the kind where a bucket is accidentally made world-readable.

• If you know a bucket should never be public, the deck’s advice is simply to leave these settings on.
• They can also be set at the account level.

5. S3 Static Website Hosting

S3 can host static websites and serve them on the Internet. The website URL depends on the region and takes one of two forms:

http://bucket-name.s3-website-aws-region.amazonaws.com
http://bucket-name.s3-website.aws-region.amazonaws.com

For a bucket called demo-bucket in us-west-2, that is http://demo-bucket.s3-website-us-west-2.amazonaws.com or http://demo-bucket.s3-website.us-west-2.amazonaws.com — note that the difference between the two forms is a dash versus a dot before the region.

Exam tip

If the site returns 403 Forbidden, the cause is almost always that the bucket policy does not allow public reads. This exact symptom appears in exam questions; the fix is the bucket policy, not a CORS setting and not object metadata.

6. S3 Versioning

You can version your files in Amazon S3, and it is enabled at the bucket level.

Once versioning is on, overwriting the same key creates a new version rather than replacing the content: version 1, then 2, then 3, and so on. It is considered best practice to version your buckets, for two reasons:

• Protection against unintended deletes — you can restore a previous version.
• Easy rollback to an earlier version of a file.

Two details are easy to trip over:

• Any file that existed before versioning was enabled has version null.
• Suspending versioning does not delete the previous versions — it only stops new ones from being created.

7. S3 Replication (CRR and SRR)

Replication copies objects from one bucket to another automatically. There are two variants:

• Cross-Region Replication (CRR) — source and destination in different regions.
• Same-Region Replication (SRR) — both in the same region.

The rules are the same for both:

• Versioning must be enabled on both the source and the destination bucket.
• The buckets can be in different AWS accounts.
• Copying is asynchronous.
• You must give S3 the proper IAM permissions to perform the copy.

Use cases differ by variant:

• CRR — compliance requirements, lower-latency access for users in another region, replication across accounts.
• SRR — log aggregation, live replication between a production account and a test account.

Replication notes that show up in questions

• After you enable replication, only new objects are replicated. Existing objects stay put unless you use S3 Batch Replication, which replicates existing objects and objects that previously failed to replicate.
• For DELETE operations: you can optionally replicate delete markers from source to target. Deletions that specify a version ID are not replicated, deliberately, so that a malicious permanent delete cannot be propagated.
• There is no chaining of replication. If bucket 1 replicates into bucket 2, and bucket 2 replicates into bucket 3, objects created in bucket 1 do not reach bucket 3.

Real-world example

A company must keep an auditable copy of production logs in a second region. They turn on versioning in both buckets and configure CRR. Then they realize the last two years of logs predate the rule and were never copied, so they run an S3 Batch Replication job to backfill them.

8. S3 Storage Classes

S3 offers a family of storage classes so you can match cost to access pattern:

• Amazon S3 Standard — General Purpose
• Amazon S3 Standard-Infrequent Access (Standard-IA)
• Amazon S3 One Zone-Infrequent Access (One Zone-IA)
• Amazon S3 Glacier Instant Retrieval
• Amazon S3 Glacier Flexible Retrieval
• Amazon S3 Glacier Deep Archive
• Amazon S3 Intelligent-Tiering

You can move objects between classes manually or automatically using S3 Lifecycle configurations.

Durability and availability

These two words sound similar and mean different things.

• Durability is the probability that an object survives. S3 spreads objects over multiple AZs to reach 99.999999999% (11 nines), and that figure does not move between storage classes. The deck’s way of picturing it: a collection of 10,000,000 objects averages the loss of one object per 10,000 years.
• Availability measures how readily the service can be reached, and it varies by storage class. S3 Standard is 99.99% available, which works out to about 53 minutes of unavailability per year.

S3 Standard — General Purpose

• Availability sits at 99.99%.
• The class to reach for when data gets read often.
• Latency stays low while throughput stays high.
• Keeps serving through 2 concurrent facility failures.
• Typical fits: big data analytics, mobile and gaming applications, content distribution.

Infrequent Access classes

These are for data that is accessed less often but still needs rapid access when it is needed, at a lower cost than S3 Standard.

• S3 Standard-IA — 99.9% availability. Use cases: disaster recovery, backups.
• S3 One Zone-IA — same 99.999999999% durability but within a single AZ, so data is lost if that AZ is destroyed. 99.5% availability. Use cases: secondary backup copies of on-premises data, or data you can recreate.

Glacier storage classes

Low-cost object storage meant for archiving and backup. Pricing is storage cost plus an object retrieval cost, which is the key difference from the other classes.

Class	Retrieval options	Minimum storage duration
Glacier Instant Retrieval	Millisecond retrieval; good for data accessed about once a quarter	90 days
Glacier Flexible Retrieval (formerly “Amazon S3 Glacier”)	Expedited (1–5 minutes), Standard (3–5 hours), Bulk (5–12 hours, free)	90 days
Glacier Deep Archive	Standard (12 hours), Bulk (48 hours)	180 days

S3 Intelligent-Tiering

Intelligent-Tiering charges a small monthly monitoring and auto-tiering fee and in exchange moves objects automatically between access tiers based on usage. Crucially, there are no retrieval charges in Intelligent-Tiering.

The tiers:

• Frequent Access tier, automatic — where every object starts.
• Infrequent Access tier, automatic — reached once an object has gone 30 days untouched.
• Archive Instant Access tier, automatic — reached at 90 days without access.
• Archive Access tier, optional — you choose a threshold anywhere from 90 days to 700+ days.
• Deep Archive Access tier, optional — same idea, with the threshold from 180 days to 700+ days.

Side-by-side comparison

	Standard	Intelligent-Tiering	Standard-IA	One Zone-IA	Glacier Instant Retrieval	Glacier Flexible Retrieval	Glacier Deep Archive
Durability	99.999999999% (11 nines) for all classes
Availability	99.99%	99.9%	99.9%	99.5%	99.9%	99.99%	99.99%
Availability SLA	99.9%	99%	99%	99%	99%	99.9%	99.9%
Availability Zones	>= 3	>= 3	>= 3	1	>= 3	>= 3	>= 3
Min. storage duration charge	None	None	30 days	30 days	90 days	90 days	180 days
Min. billable object size	None	None	128 KB	128 KB	128 KB	40 KB	40 KB
Retrieval fee	None	None	Per GB retrieved	Per GB retrieved	Per GB retrieved	Per GB retrieved	Per GB retrieved

The deck’s price table uses us-east-1. Monthly storage per GB spans $0.023 at the Standard end and $0.00099 at the Glacier Deep Archive end, with Standard-IA at $0.0125, One Zone-IA at $0.01, Glacier Instant Retrieval at $0.004, Glacier Flexible Retrieval at $0.0036, and Intelligent-Tiering between $0.0025 and $0.023 according to which tier holds the object. Retrieval is billed per 1000 requests, and the trade is visible: the cheaper the storage, the pricier getting data back. Glacier Flexible Retrieval lists Expedited: $10, Standard: $0.05 and Bulk: free; Deep Archive lists Standard: $0.10 and Bulk: $0.025. Intelligent-Tiering carries a separate monitoring line of $0.0025 per 1000 objects.

Exam tip

Cost questions are usually decided by the minimum storage duration and the retrieval time, not by the headline per-GB price. Data kept for less than 30 days in Standard-IA still gets billed for 30 days; an object that must come back in minutes cannot live in Deep Archive; and “no retrieval charge, unknown access pattern” points squarely at Intelligent-Tiering.

Real-world example

A photo-sharing app keeps freshly uploaded pictures in Standard, moves them to Standard-IA once they stop being viewed, and archives originals older than a year in Glacier Flexible Retrieval, where a Bulk restore is free and 5–12 hours is acceptable for a rare “recover my old album” request. The regenerated thumbnails, which can be rebuilt at any time, sit in One Zone-IA because losing an AZ only costs CPU time.

9. S3 Express One Zone

S3 Express One Zone is a high-performance, single-Availability-Zone storage class. Objects are stored in a Directory Bucket, which is a bucket that lives in a single AZ (its name looks like stephane--use1-az4--x-s3).

What it offers:

• Handles hundreds of thousands of requests per second with single-digit millisecond latency.
• Up to 10x better performance than S3 Standard, at 50% lower cost.
• 99.999999999% durability and 99.95% availability.
• Lets you co-locate storage and compute in the same AZ, which is where the latency reduction comes from.

Use cases: latency-sensitive applications, data-intensive applications, AI and ML training, financial modeling, media processing, HPC. It is best integrated with SageMaker Model Training, Athena, EMR and Glue.

Quick recap

Item	What to remember for the exam
Bucket	Name is globally unique, but the bucket belongs to one region; 3–63 characters, no uppercase, no _, not an IP, no xn-- prefix, no -s3alias suffix
Object	Key = full path = prefix + object name; no real directories; max 5 TB; > 5 GB must use multi-part upload; up to 10 tags
Access decision	Allowed when (IAM ALLOW OR resource policy ALLOW) AND no explicit DENY
Which mechanism	Public visitor → bucket policy; user in your account → IAM policy; EC2 → instance role; another account → bucket policy
Block Public Access	Prevents data leaks; can be set at the account level; leave on for any bucket that should never be public
Static website	URL is bucket-name.s3-website-aws-region.amazonaws.com or bucket-name.s3-website.aws-region.amazonaws.com; 403 Forbidden means the bucket policy does not allow public reads
Versioning	Enabled at bucket level; pre-existing files have version null; suspending does not delete old versions
Replication	Versioning required on both buckets, copying is asynchronous; only new objects (use S3 Batch Replication for existing ones); no chaining; deletes with a version ID are not replicated
Durability vs availability	Durability 11 nines for every class; availability varies by class (Standard 99.99% = about 53 minutes per year)
Min. storage duration	Standard and Intelligent-Tiering: none; Standard-IA and One Zone-IA: 30 days; Glacier Instant Retrieval and Flexible Retrieval: 90 days; Deep Archive: 180 days
Retrieval times	Glacier Instant Retrieval: milliseconds; Flexible: Expedited 1–5 min / Standard 3–5 h / Bulk 5–12 h; Deep Archive: Standard 12 h / Bulk 48 h
One Zone-IA	Same 11 nines durability but in one AZ — data is lost if the AZ is destroyed; 99.5% availability
Intelligent-Tiering	Auto-tiers on usage, no retrieval charges; automatic tiers at 30 days (IA) and 90 days (Archive Instant Access)
S3 Express One Zone	Directory Bucket in 1 AZ, single-digit ms latency, 10x faster than Standard, 50% cheaper, availability 99.95%