Amazon S3

AWS CLF-C02 — Domain 3: Cloud Technology & Services

S3 Overview

S3 = Simple Storage Service — "infinitely scaling" object storage
Store objects (files) in buckets (directories)
Objects can be up to 5 TB in size (use multi-part upload for files > 5 GB)
Bucket names must be globally unique across all AWS accounts
Buckets are defined at the Region level
Objects have a key (full path), e.g., s3://my-bucket/folder/file.txt
No concept of "directories" in S3 — just keys with prefixes that look like paths
Object metadata (key-value pairs), tags, and version ID

Key Point:

S3 is object storage (not block or file storage). Bucket names are globally unique. Objects are accessed via keys. S3 provides 11 9s (99.999999999%) of durability.

S3 Security

Bucket Policies

JSON-based policies attached directly to the S3 bucket
Can grant cross-account access
Can force encryption at upload, restrict by IP, require MFA
Most common way to make a bucket public or grant access to specific principals

Access Control Lists (ACLs)

Older mechanism, less flexible than bucket policies
Object ACL — fine-grained control at the object level
Bucket ACL — less common, broad control at the bucket level
AWS recommends disabling ACLs and using bucket policies instead

S3 Encryption

Type	Description	Key Management
SSE-S3	Server-Side Encryption with S3-managed keys. Default encryption.	AWS manages keys entirely (AES-256)
SSE-KMS	Server-Side Encryption with KMS keys. Gives you audit trail via CloudTrail.	You manage keys in AWS KMS, control rotation
SSE-C	Server-Side Encryption with customer-provided keys. Must use HTTPS.	You provide and manage the key with every request
Client-Side	Encrypt data on the client before sending to S3.	You manage everything — encryption and keys

Exam Tip:

"Default encryption for S3?" → SSE-S3 (AES-256). "Encryption with audit trail of key usage?" → SSE-KMS. "Customer provides their own encryption key?" → SSE-C. All new buckets have SSE-S3 enabled by default.

S3 Static Website Hosting

S3 can host static websites (HTML, CSS, JS, images) accessible via HTTP
Website URL format: http://bucket-name.s3-website-region.amazonaws.com
Must enable static website hosting on the bucket
Must make the files public using a bucket policy
Specify an index document (e.g., index.html) and optionally an error document
If you get a 403 Forbidden error, check the bucket policy for public read access

S3 Versioning

Keep multiple versions of an object in the same bucket
Enabled at the bucket level
Protects against unintended deletes (can restore previous versions)
Protects against unintended overwrites
Any file not versioned before enabling versioning will have version null
Suspending versioning does not delete previous versions
Deleting a versioned object adds a delete marker (can be removed to restore)

Key Point:

Versioning is a prerequisite for S3 Replication (CRR/SRR). It is considered a best practice to enable versioning on all important buckets.

S3 Replication

Type	Full Name	Description
CRR	Cross-Region Replication	Replicate objects to a bucket in a different Region. Use cases: compliance, lower latency, cross-account replication.
SRR	Same-Region Replication	Replicate objects to a bucket in the same Region. Use cases: log aggregation, live replication between production and test accounts.

Versioning must be enabled on both source and destination buckets
Buckets can be in different AWS accounts
Replication is asynchronous
Must give proper IAM permissions to S3 for replication
Only new objects are replicated after enabling (not retroactive — use S3 Batch Replication for existing objects)
Delete markers are not replicated by default

Exam Tip:

"Replicate S3 data to another Region for compliance?" → CRR. "Aggregate logs from multiple buckets in the same Region?" → SRR. Both require versioning enabled.

S3 Storage Classes

Storage Class	Durability	Availability	Min Storage Duration	Retrieval Time	Use Case
S3 Standard	99.999999999% (11 9s)	99.99%	None	Instant	Frequently accessed data, big data analytics, gaming, content distribution
S3 Standard-IA	99.999999999%	99.9%	30 days	Instant	Infrequently accessed but needs rapid access (disaster recovery, backups)
S3 One Zone-IA	99.999999999%	99.5%	30 days	Instant	Infrequent access, data you can recreate (secondary backups, thumbnails)
S3 Glacier Instant Retrieval	99.999999999%	99.9%	90 days	Milliseconds	Archive data accessed once a quarter with instant access
S3 Glacier Flexible Retrieval	99.999999999%	99.99%	90 days	Expedited: 1-5 min, Standard: 3-5 hrs, Bulk: 5-12 hrs	Archive data accessed 1-2 times per year
S3 Glacier Deep Archive	99.999999999%	99.99%	180 days	Standard: 12 hrs, Bulk: 48 hrs	Long-term archive, data retained for 7-10+ years, compliance
S3 Intelligent-Tiering	99.999999999%	99.9%	None	Instant (for frequent/infrequent tiers)	Unknown or changing access patterns. Auto-moves objects between tiers. Small monthly monitoring fee, no retrieval charges.

Key Point:

All S3 storage classes have 11 9s (99.999999999%) durability. They differ in availability, retrieval time, and cost. One Zone-IA stores data in only 1 AZ (risk of AZ destruction).

Exam Tip:

"Cheapest long-term archive?" → Glacier Deep Archive. "Archive with instant access?" → Glacier Instant Retrieval. "Unpredictable access patterns?" → Intelligent-Tiering. "Infrequent access, can recreate data?" → One Zone-IA.

S3 Lifecycle Rules

Automate transitioning objects between storage classes based on age
Automate expiring (deleting) objects after a specified period
Can apply to the entire bucket or a specific prefix/tag

Two Types of Actions

Action Type	Description	Example
Transition Actions	Move objects to another storage class after X days	Move to Standard-IA after 30 days, move to Glacier after 90 days
Expiration Actions	Delete objects after X days	Delete access logs after 365 days, delete incomplete multi-part uploads after 7 days

Exam Tip:

"How to automatically move objects to cheaper storage over time?" → S3 Lifecycle Rules with Transition Actions. "How to auto-delete old objects?" → Lifecycle Rules with Expiration Actions.

S3 Event Notifications

React to events happening in your S3 bucket (e.g., object created, deleted, restored)
Can trigger:
- SNS (Simple Notification Service) — send notifications
- SQS (Simple Queue Service) — queue messages for processing
- Lambda Functions — run code in response to events
- Amazon EventBridge — advanced filtering, multiple destinations, replay events
Use case: generate thumbnails when images are uploaded, trigger data processing pipelines

S3 Presigned URLs

Generate a temporary URL that gives access to a private S3 object
URL has an expiration time (default 1 hour, max 7 days)
The person with the URL inherits the permissions of the user who generated it
Use cases:
- Allow a user to download a private file without making it public
- Allow a user to upload a file to a specific location in your bucket
- Premium content downloads, temporary file sharing

Exam Tip:

"How to give temporary access to a private S3 object without making the bucket public?" → Presigned URL. This is a very commonly tested concept.

S3 Access Points

Simplify managing access to S3 buckets with shared datasets
Each access point has its own DNS name and access point policy
Instead of one complex bucket policy, create separate access points for different use cases (e.g., finance team, analytics team)
Each access point can be restricted to a specific VPC (VPC origin)
S3 Object Lambda Access Points — use Lambda functions to transform objects before returning them (e.g., redact PII, resize images, convert formats)

S3 Object Lock & Transfer Acceleration

S3 Object Lock

Store objects using a WORM (Write Once Read Many) model
Prevents objects from being deleted or overwritten for a fixed period or indefinitely
Versioning must be enabled
Two retention modes:
- Governance Mode: Users with special permissions can override lock
- Compliance Mode: No one (not even root) can delete the object during retention period
Legal Hold: Protects an object indefinitely until the hold is removed, independent of retention
Use case: regulatory compliance, SEC Rule 17a-4, legal requirements

S3 Transfer Acceleration

Speed up uploads and downloads to/from S3 for long-distance transfers
Uses AWS Edge Locations as an intermediary
File is uploaded to the nearest Edge Location, then transferred over AWS's fast private network to the S3 bucket
Compatible with multi-part upload
Use case: users worldwide uploading to a single S3 bucket

Exam Tip:

"Prevent object deletion for compliance (WORM)?" → S3 Object Lock. "Speed up S3 uploads from far-away users?" → S3 Transfer Acceleration. "Even the root user cannot delete?" → Compliance Mode.

S3 Quick Reference

Feature	Key Fact
Max object size	5 TB
Multi-part upload required	Files > 5 GB (recommended for > 100 MB)
Bucket name	Globally unique, 3-63 characters, lowercase
Durability	99.999999999% (11 nines) for all classes
Default encryption	SSE-S3 (AES-256)
Versioning	Bucket-level, required for replication
Lifecycle rules	Transition + Expiration actions
Replication	CRR (cross-region) or SRR (same-region), requires versioning
Static hosting	HTTP only (use CloudFront for HTTPS)
Free Tier	5 GB Standard storage, 20,000 GET, 2,000 PUT for 12 months