Amazon S3 (Simple Storage Service) is AWS's object storage service. It lets you store and retrieve any amount of data — files, images, videos, backups, logs, ML datasets — from anywhere on the internet. Unlike a hard drive with folders and files, S3 stores data as objects inside buckets, each identified by a unique key.

S3 was one of the first AWS services, launched in 2006. Today it stores trillions of objects and handles millions of requests per second across AWS customers. It is the most-used AWS storage service and the foundation of most data architectures on AWS.

Understanding the storage type is critical for choosing the right service:

Type	How It Works	AWS Service	Best For
Object Storage	Flat namespace — key → object. No folders. Access via HTTP.	S3	Files, images, backups, data lakes, logs
Block Storage	Raw disk blocks. OS mounts it like a hard drive. Low latency.	EBS	Databases, boot volumes, OS-level read/write
File Storage	Shared filesystem with directories. NFS protocol.	EFS	Shared access across multiple EC2 instances

S3 is referenced by almost every AWS service:

Think of S3 like a post office with infinite numbered mailboxes:

Two different guarantees — both important, often confused on the exam:

Use Case	How S3 Is Used	Why It Works
Static Website Hosting	Serve HTML/CSS/JS from a bucket with public access	No server needed — scales to any traffic automatically
Database Backups	Dump files pushed to S3 on a schedule	Cheap, durable, cross-region replication available
User Uploads	Presigned URLs let users upload directly to S3	Bypass your app server for large files
Data Lake	Raw data (JSON, Parquet, CSV) stored in S3, queried with Athena	Decouple storage from compute — pay per query
Log Archive	CloudTrail, ALB access logs, VPC flow logs → S3	Long-term storage, lifecycle to Glacier after 90 days
CDN Origin	CloudFront serves from S3 origin globally	Edge caching + S3 durability = best of both worlds

Since December 2020, Amazon S3 provides strong read-after-write consistency for all operations — at no additional cost and with no performance impact. This was a major change from S3's original eventual consistency model.

A bucket is the top-level container for objects in S3. Every object lives inside a bucket. Buckets are created in a specific AWS region and data does not leave that region unless you explicitly configure replication.

An object is the fundamental unit of data in S3. It consists of the data itself plus metadata. Every object is identified by a key — a string that uniquely identifies the object within its bucket.

Component	What It Is	Example
Key	The full "path" of the object within the bucket	images/2026/logo.png
Value	The actual data — any bytes, any format	Binary PNG file data
Version ID	Unique ID per version (when versioning is enabled)	ab3c4de5fg6h
Metadata	Key-value pairs describing the object	Content-Type: image/png
Tags	User-defined labels for cost allocation or access control	env=prod, team=frontend
ETag	MD5 hash of the object — used to verify integrity	d41d8cd98f00b204e9800998ecf8427e

S3 offers multiple storage classes, each optimized for different access frequency and cost profiles. You pay less per GB for classes you access less frequently — but you pay a retrieval fee when you do access them.

Storage Class	Access Pattern	Availability	Retrieval Fee	Best For
S3 Standard	Frequent access	99.99%	None	Active data, websites, apps
S3 Intelligent-Tiering	Unknown / changing	99.9%	None	Data with unpredictable patterns
S3 Standard-IA	Infrequent (monthly)	99.9%	Per GB retrieved	Backups, disaster recovery
S3 One Zone-IA	Infrequent, single AZ	99.5%	Per GB retrieved	Re-creatable data, secondary backups
S3 Glacier Instant	Rare (quarterly)	99.9%	Per GB retrieved	Archive with instant access
S3 Glacier Flexible	Rare — minutes to hours	99.99%	Per GB + request	Compliance archives, tape replacement
S3 Glacier Deep Archive	Very rare — 12h retrieval	99.99%	Per GB + request	7–10 year regulatory archives

Versioning keeps multiple versions of an object in the same bucket. Every time you overwrite or delete an object, S3 creates a new version instead of destroying the old one.

Understanding request types matters for cost calculation — you pay per request:

Request Type	Operation	Relative Cost
PUT / COPY / POST / LIST	Write or list operations	Higher ($0.005 per 1,000)
GET / SELECT	Read object data	Lower ($0.0004 per 1,000)
DELETE	Delete object	Free
Lifecycle transitions	Move object between storage classes	Per-transition fee

By default, all S3 buckets and objects are private. Nothing is publicly accessible unless you explicitly allow it. Access to S3 is controlled through multiple overlapping layers — understanding which layer applies when is the key to both security and the SAA-C03 exam.

IAM policies grant S3 permissions to AWS identities. The identity must have permissions AND the bucket policy must allow (or at least not deny) the request.

IAM Action	What It Allows
s3:GetObject	Download / read an object
s3:PutObject	Upload / write an object
s3:DeleteObject	Delete an object
s3:ListBucket	List objects in a bucket
s3:GetBucketPolicy	Read the bucket policy
s3:PutBucketPolicy	Write / replace the bucket policy
s3:*	Full access to all S3 actions (admin)

Bucket policies are JSON documents attached directly to a bucket. They can grant or deny access to specific AWS accounts, IAM users/roles, services, or the public. They are the primary mechanism for cross-account access and public access.

Block Public Access is a safety switch that sits above bucket policies and ACLs. Even if your bucket policy grants public access, Block Public Access will override and deny it.

S3 Access Points simplify managing access to shared datasets in S3. Instead of one complex bucket policy that handles every application, each application gets its own named endpoint with its own access policy — scoped to exactly what it needs.

A VPC Gateway Endpoint allows EC2 instances and other resources in a private subnet to access S3 without going through the internet — no NAT Gateway, no Internet Gateway, no public IP required.

A presigned URL grants temporary access to a private S3 object without making the bucket public. Any identity with the right IAM permissions can generate one.

S3 supports encryption at rest and in transit. Since January 2023, all new objects are encrypted by default with SSE-S3.

Type	Key Management	Use Case	Exam Note
SSE-S3	AWS manages keys completely	Default — zero management overhead	Header: x-amz-server-side-encryption: AES256
SSE-KMS	AWS KMS — you control the key policy	Compliance, audit trail, cross-account control	CloudTrail logs every key usage. Adds KMS API call cost.
SSE-C	You provide the key on every request	You manage keys outside AWS completely	AWS never stores your key — must be sent with every PUT/GET.
Client-side	You encrypt before upload	Zero trust — AWS never sees plaintext	Application owns the full encryption lifecycle.

Access Control Lists (ACLs) are the original S3 access mechanism. AWS now recommends disabling ACLs and using bucket policies instead. However, ACLs still appear on certifications.

ACL Permission	What It Allows
READ	List objects (bucket) or download object
WRITE	Upload/delete objects in bucket
READ_ACP	Read the ACL itself
WRITE_ACP	Modify the ACL
FULL_CONTROL	All of the above

Lifecycle rules automate the movement and deletion of objects over time. They eliminate the need to manually manage aging data — define the rules once, and S3 handles the transitions and expirations automatically.

S3 Replication automatically and asynchronously copies objects from one bucket to another. Versioning must be enabled on both source and destination buckets.

Replication Behaviour	Detail
What replicates	New objects after replication is enabled. Existing objects need S3 Batch Replication.
Delete behaviour	Delete markers are NOT replicated by default (can be enabled). Permanent deletes never replicate.
Storage class	Destination uses same class by default. Can override to a cheaper class.
Ownership	Replicated objects are owned by source account by default. Use Object Ownership setting to change.
Chaining	Replication is not transitive — A→B→C does NOT automatically replicate A to C.
Encryption	SSE-S3 and SSE-KMS objects can be replicated. SSE-C objects cannot.

Object Lock prevents objects from being deleted or overwritten for a defined period. It implements WORM (Write Once Read Many) storage — required for SEC 17a-4, HIPAA, and financial compliance workloads.

S3 can publish events when objects are created, deleted, restored, or replicated. This enables event-driven architectures where downstream systems react to data changes automatically.

Event Type	Triggered When	Common Use
s3:ObjectCreated:*	Any object is uploaded (PUT, POST, COPY, multipart)	Trigger processing pipeline on upload
s3:ObjectRemoved:*	Object is deleted	Audit deletion, update downstream index
s3:ObjectRestore:*	Glacier object restore initiated/completed	Notify when archive is available
s3:Replication:*	Replication failure or missed threshold	Alert on replication health issues

S3 Batch Operations runs large-scale jobs across billions of objects with a single API call. Instead of writing scripts to iterate through objects, you describe the operation and S3 runs it at scale.

S3 scales automatically — there are no capacity limits to configure, no partitions to manage, and no pre-warming required. AWS manages the infrastructure horizontally behind the scenes. However, understanding S3's performance characteristics helps you avoid hitting rate limits on high-throughput workloads.

A prefix is the part of an object key before the final filename — essentially the "path". S3 uses prefixes to distribute requests across its internal infrastructure. More distinct prefixes = more parallelism = higher throughput.

Multipart Upload splits large objects into parts, uploads them in parallel, and reassembles them on S3. It is the correct mechanism for any object above 100 MB.

Feature	Detail
Minimum part size	5 MB (except the last part)
Maximum parts	10,000 parts per object
Maximum object size	5 TB (requires multipart)
Parallel uploads	Upload all parts simultaneously — dramatically faster on high-bandwidth connections
Resume on failure	Only the failed part needs to be retried — not the entire object
Incomplete uploads	Parts are billed even if never completed — use lifecycle rule to abort after N days

Transfer Acceleration routes uploads through AWS CloudFront edge locations instead of going directly to the S3 regional endpoint. Data enters the AWS backbone at the nearest edge location, then travels on AWS's private network to S3 — which is faster and more reliable than routing over the public internet for long distances.

S3 Select allows you to retrieve only the subset of data you need from an object using SQL expressions — without downloading the entire file. Instead of downloading a 5 GB CSV and filtering locally, S3 filters on the server and returns only matching rows.

You can retrieve specific byte ranges of an object using the HTTP Range header. This enables parallel downloads and efficient partial reads without fetching the entire object.

S3 has no up-front cost and no minimum fee. You pay only for what you use across four dimensions:

These are approximate US East (N. Virginia) prices to illustrate relative costs. Always check the AWS pricing page for current rates in your region.

Storage Class	Storage ($/GB/month)	Retrieval ($/GB)	Min Storage Duration	Min Object Size
S3 Standard	~$0.023	Free	None	None
S3 Intelligent-Tiering	~$0.023 (frequent tier)	Free	None	128 KB (smaller = Standard)
S3 Standard-IA	~$0.0125	~$0.01/GB	30 days	128 KB billed minimum
S3 One Zone-IA	~$0.01	~$0.01/GB	30 days	128 KB billed minimum
S3 Glacier Instant	~$0.004	~$0.03/GB	90 days	128 KB billed minimum
S3 Glacier Flexible	~$0.0036	~$0.01–0.03/GB	90 days	40 KB billed minimum
S3 Glacier Deep Archive	~$0.00099	~$0.02/GB	180 days	40 KB billed minimum

Intelligent-Tiering (INT) automatically moves objects between access tiers based on actual usage — no retrieval fees, no lifecycle rules to manage. It is the right choice when access patterns are unknown or unpredictable.

S3 Storage Lens provides org-wide visibility into S3 usage, activity trends, and cost optimization recommendations across all buckets and accounts in your AWS Organization.

Scenario	Right Choice	Reason
Frequently accessed app data	S3 Standard	No retrieval fee, no min duration
Access pattern is unknown	S3 Intelligent-Tiering	Auto-optimizes without lifecycle rules
Backup accessed once/month	S3 Standard-IA	50% cheaper storage, low retrieval frequency
Replicated data (can re-create)	S3 One Zone-IA	20% cheaper than Standard-IA, acceptable single-AZ risk
Compliance archive, instant access	S3 Glacier Instant	~83% cheaper than Standard, ms retrieval
7+ year regulatory archive	S3 Glacier Deep Archive	~96% cheaper than Standard, 12h retrieval acceptable
Short-lived temp files (<30 days)	S3 Standard	IA min-duration billing makes IA more expensive

S3 can serve HTML, CSS, JavaScript, and image files directly as a website — no web server, no EC2, no maintenance. For read-heavy static content, this is the simplest and cheapest architecture on AWS.

Users upload files directly to S3, bypassing your application server entirely. Your backend generates a short-lived presigned URL and returns it to the client. The client uploads directly to S3 — your server never touches the bytes.

S3 is the standard storage layer for data lakes on AWS. Raw data lands in S3, is catalogued with Glue, and queried in-place with Athena — no database to provision, no ETL until you need it.

S3 events drive serverless processing pipelines — no polling, no scheduler, no idle workers. Every object upload automatically triggers the next stage of processing.

Mistake	Why It's Bad	Fix
Making bucket public for all content	Exposes all objects — including future uploads	Keep bucket private, use CloudFront OAC + presigned URLs
No lifecycle rules	Storage cost grows unbounded over months/years	Set lifecycle rules on day one for every bucket
Using S3 as a database	No query capability, no indexing — extremely slow lookups	Store metadata in DynamoDB/RDS, store files in S3
Ignoring incomplete multipart uploads	Parts accumulate silently and are billed indefinitely	Lifecycle rule: abort incomplete multipart after 7 days
Moving to IA too aggressively	Min-duration billing + retrieval fees make it more expensive for frequent access	Use S3 Analytics or Intelligent-Tiering to identify true access patterns
Not enabling versioning on important buckets	One accidental delete or overwrite = permanent data loss	Enable versioning + lifecycle expire old versions
Storing credentials in S3 objects	Exposed if bucket is ever misconfigured	Use Secrets Manager or SSM Parameter Store