S3 is object storage: unlimited objects in buckets, designed for 11 nines of durability. Overview is in 4. AWS Storage and Databases; securing it is also covered in 4. Cloud Security.

Parts at a glance

Strong read-after-write consistency applies to all operations. Single PUT up to 5 GB; use multipart upload above about 100 MB and required above 5 GB.

Storage Classes

IA and Glacier classes have minimum storage durations and minimum object size charges; deleting early still bills the minimum.

Lifecycle Rules

{
  "Rules": [{
    "ID": "archive-and-expire-logs",
    "Status": "Enabled",
    "Filter": { "Prefix": "logs/" },
    "Transitions": [
      { "Days": 30,  "StorageClass": "STANDARD_IA" },
      { "Days": 90,  "StorageClass": "GLACIER" }
    ],
    "Expiration": { "Days": 365 },
    "NoncurrentVersionExpiration": { "NoncurrentDays": 30 },
    "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
  }]
}

$ aws s3api put-bucket-lifecycle-configuration --bucket my-unique-bucket-12345 --lifecycle-configuration file://lifecycle.json

Always include abort incomplete multipart uploads and expire noncurrent versions; both silently accumulate cost.

Versioning, MFA Delete and Object Lock

• Versioning: every overwrite or delete keeps history; a delete adds a delete marker. Recover by removing the marker or fetching an older version. Once enabled it can only be suspended
• MFA Delete: require MFA to permanently delete versions
• Object Lock (needs versioning): WORM protection
• Governance mode: privileged users can override
• Compliance mode: nobody, not even root, can delete until retention ends
• Legal hold: indefinite hold until removed
• Use for ransomware resilience and regulated retention

Encryption

In transit: enforce TLS with a bucket policy:

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": ["arn:aws:s3:::my-unique-bucket-12345", "arn:aws:s3:::my-unique-bucket-12345/*"],
  "Condition": { "Bool": { "aws:SecureTransport": "false" } }
}

Access Control

Evaluation: an explicit deny wins; otherwise access needs an allow from IAM or the bucket policy (same account) or both (cross-account).

$ aws s3 presign s3://my-unique-bucket-12345/report.pdf --expires-in 900
$ aws s3api put-public-access-block --bucket my-unique-bucket-12345 \
    --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Hosting Static Sites

Events and Integrations

• Event notifications to Lambda, SQS, SNS or EventBridge on object create, remove, restore, replication
• Typical pipeline: upload, event, Lambda processes (thumbnails, parse CSV), result written back to another bucket (use a different bucket or prefix to avoid trigger loops)
• Athena queries data in place; S3 Select / Glacier restore for partial reads; Batch Operations for bulk changes (copy, tag, restore, invoke Lambda)
• Inventory reports list objects and metadata for audits

Replication

Requires versioning on both buckets and an IAM role. Replicates new objects by default; use Batch Replication for existing ones. Delete markers replication is optional. Replication Time Control gives a time-bound SLA.

Performance

• Scales to thousands of requests per second per prefix; spread hot keys across prefixes
• Multipart upload for large files, parallel uploads, byte-range GETs for parallel downloads
• Transfer Acceleration uses edge locations for faster long-distance uploads
• CloudFront in front for repeated reads

Everyday CLI

$ aws s3 mb s3://my-unique-bucket-12345 --region af-south-1
$ aws s3 ls s3://my-unique-bucket-12345 --recursive --human-readable --summarize
$ aws s3 cp file.txt s3://my-unique-bucket-12345/
$ aws s3 sync ./site s3://my-unique-bucket-12345 --delete
$ aws s3 rm s3://my-unique-bucket-12345 --recursive
$ aws s3api put-bucket-versioning --bucket my-unique-bucket-12345 --versioning-configuration Status=Enabled
$ aws s3api list-object-versions --bucket my-unique-bucket-12345 --prefix report.pdf

aws s3 is the high-level, friendly command set; aws s3api exposes every API option.

Monitoring and Cost

• CloudTrail data events for object-level audit; server access logs for request logs
• Storage Lens and Storage Class Analysis show usage and savings
• Costs: storage (per class), requests, data transfer out, retrieval fees, lifecycle transitions, replication, KMS requests
• Savings: lifecycle rules, Intelligent-Tiering, delete old versions, abort multipart uploads, VPC gateway endpoint (free) instead of NAT

Common Mistakes