Amazon S3

Amazon S3 Quick Notes

Basics

• Model: Object store (not a mountable disk). Objects live in buckets.
• Object size: 0 bytes → 5 TB.
• Bucket names: Globally unique; created in a Region.
• Structure: Flat; “folders” are prefixes (e.g. images/).
• High request rates: Use many prefixes — don’t create a bucket per customer as the first fix.

Storage Classes

Class: When to use

Standard: Hot, frequent access; short-lived staging

Standard-IA: Infrequent but immediate; ~30-day min

One Zone-IA: Infrequent + replaceable; single AZ

Intelligent-Tiering: Unknown / changing patterns; no retrieval fees for F/IA tiers

Glacier Instant: Archive with millisecond get (~quarterly access)

Glacier Flexible: Minutes–hours retrieval

Glacier Deep Archive: Cheapest; hours–days; ~180-day min

• Same 1 GB cost order (exam): S3 Standard < EFS < EBS (you pay for provisioned EBS GB).

Lifecycle

• Actions: Transition and/or expiration rules (prefix/tag filters allowed).
• Invalid transitions: One Zone-IA → Standard-IA; Intelligent-Tiering → Standard.
• Snow → archive: Snowball jobs target an S3 bucket, then lifecycle to Deep Archive (not a Glacier vault directly).

Versioning & MFA Delete

• States: Disabled → Enabled → Suspended (cannot fully disable once enabled).
• Simple delete: Creates a delete marker (prior versions remain).
• MFA Delete: MFA required to change versioning state and permanently delete versions.

Encryption (SSE)

Method, Who holds keys, Notes

SSE-S3, S3, Default / AES256; least control

SSE-KMS, KMS, Audit + key policy + role separation

SSE-C, You, Bring key every request; AWS encrypts

Client-side, You, Encrypt before upload; strongest isolation

• Bucket Keys: Cut KMS API call volume/cost on high Put rates (not retroactive).
• Same key across Regions for CRR: Use a KMS multi-Region key.

Access Control

• Bucket policies: Same-account and cross-account; user-level + account-level.
• Object ownership trap: Uploader account owns the object by default (classic Redshift UNLOAD issue).
• Block Public Access: Account/bucket guardrails against accidental public grants.
• Requester Pays: Requester pays for requests/download when enabled.

Replication

• SRR / CRR: Same Region / cross-Region. Versioning required on source and destination.
• Not retroactive: Use S3 Batch Replication and/or aws s3 sync for existing objects.

Object Lock (WORM)

• Compliance mode: Even root cannot shorten/delete until expiry.
• Governance mode: Privileged bypass with special permission.
• Legal hold: ON/OFF latch with no retention period.
• Vault Lock: Separate WORM control plane for Glacier vaults.

Performance Helpers

• Multipart upload: Prefer for objects typically ≥ 100 MB.
• Transfer Acceleration (S3TA): Edge-accelerated uploads. No S3TA fee if AWS decides it did not accelerate.
• Presigned URLs: Temporary access with the signer’s permissions.