Amazon S3AuthorCloudBrum editorial teamLast reviewed27 Oct 2026Reading time~12 minLevelBeginner to advanced

• Objects, not filesYou store an object under a key such as invoices/2026/10/inv-1042.pdf. There are no real folders, only keys with slashes in them, and a single object can be up to 50 TB.
• A class for every access patternStandard for hot data, Intelligent-Tiering when you can’t predict it, the infrequent-access classes for backups, and three Glacier classes for archives. Express One Zone gives single-digit millisecond latency in one zone.
• Built to not lose dataS3 is designed for 11 nines of durability, and most classes keep copies in at least three Availability Zones. Reads after a write are consistent, including list calls.
• Versioning and Object LockKeep every version of an object so a bad overwrite or delete can be undone. Object Lock adds write-once-read-many retention for records that must not change.
• Lifecycle rulesMove data to a cheaper class after N days, expire it, and tidy up old versions and unfinished uploads, all without a script.
• Private by defaultNew buckets block public access, have ACLs switched off, and encrypt new objects with S3-managed keys. You choose when to loosen anything, and you can switch to KMS keys.
• Events when objects changeSend a notification to Lambda, SQS, SNS or EventBridge when something is created or removed, which is how a lot of serverless pipelines start.
• Replication and global reachCopy objects to another bucket in the same Region or a different one, and speed up long-distance uploads with Transfer Acceleration or multi-Region access points.

Bucket

The container for your objects. Its name is unique across AWS, and it lives in one Region.

Object

A piece of data plus its key, metadata and (if you use it) a version ID.

Key and prefix

The key is the object’s full name. A prefix is the leading part up to a slash, and it behaves like a folder in the console but isn’t one.

Storage class

How S3 keeps and charges for the object, from Standard to Glacier Deep Archive. You pick it per object.

Versioning

When on, every overwrite or delete keeps the older copy. A delete just adds a delete marker on top.

Lifecycle rule

A bucket-level instruction such as move to Standard-IA after 30 days, or delete noncurrent versions after 90.

Bucket policy

A JSON policy attached to the bucket that says who may do what, including conditions such as TLS only or a specific VPC endpoint.

Block Public Access

A set of switches, at account or bucket level, that overrides any policy or ACL that would make data public.

Presigned URL

A temporary link signed with your credentials. Whoever holds it can upload or download one object until it expires.

Access point

A named door into a bucket with its own policy, handy when many teams or apps share one large bucket.

Multipart upload

Large objects sent in parts, in parallel, and assembled by S3. Up to 10,000 parts of 5 MiB to 5 GiB each.

Object Lock

Write-once-read-many protection. Retention mode and a hold stop an object being deleted or changed for a set time.

Event notification

A message sent when an object is created, removed or restored. The target is Lambda, SQS, SNS or EventBridge.

Replication

Automatic copying of new objects to another bucket, in the same Region (SRR) or a different one (CRR), usually with versioning on both.

Set up a private bucket from the AWS console

1. Pick the Region firstOpen S3 and check the Region in the top bar. Choose the one closest to the people and services that use the data. You can’t move a bucket later without copying everything.
2. Name the bucketGeneral purpose bucket, then a name that’s unique across AWS, lower case, 3 to 63 characters. Include something that tells you what it is, such as acme-prod-invoices-ap-south-1.
3. Leave Block Public Access onIt’s ticked by default. Keep it ticked. If a website really has to serve files publicly, put CloudFront in front instead of opening the bucket.
4. Turn on versioningIt costs a little extra for old copies, and it’s the cheapest insurance you can buy against deleting the wrong thing.
5. Check the encryptionNew objects get S3-managed keys (SSE-S3) automatically. Choose SSE-KMS if you need your own key, an audit trail of key use, or the ability to disable access by disabling the key.
6. Upload somethingDrag a file into the bucket. For anything over a few hundred megabytes use the CLI or an SDK, which upload in parts and retry failed ones.
7. Add a lifecycle ruleUnder Management, create a rule: move current objects to a cheaper class after the period that matches your reads, delete noncurrent versions after 90 days, and abort incomplete multipart uploads after 7 days.
8. Write the access downGrant your application a role with just s3:GetObject and s3:PutObject on the prefix it needs. Add a bucket policy that denies any request not using TLS.
9. Watch itSwitch on CloudWatch request metrics for the busy prefixes, add S3 Storage Lens, and set a budget alert so you hear about a runaway job before the invoice.

• Spread load over prefixes. Each partitioned prefix can take at least 3,500 write and 5,500 read requests a second, and the limits add up across prefixes.
• Use multipart upload for anything big, and run parts in parallel. The SDKs' transfer managers do this for you.
• Download large objects with byte-range requests in parallel, in chunks of about 8 to 16 MB.
• Put CloudFront in front of content that many people read, so most requests never reach the bucket.
• Use Transfer Acceleration for long-distance uploads, or run the client in the same Region as the bucket.
• Try S3 Express One Zone (directory buckets) when you need single-digit millisecond latency for many small requests, such as machine learning training data.
• Keep objects reasonably sized. Millions of tiny files mean millions of requests, so batch small files into larger ones where you can.
• Use an S3 gateway VPC endpoint so traffic from your VPC stays on the AWS network and avoids a NAT gateway.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Amazon S3.

• Match the storage class to real access. Look at Storage Lens and access logs before moving data, because retrieving from a cold class can cost more than you saved.
• Use Intelligent-Tiering when access is unpredictable. It moves objects on its own, with a small monitoring fee per object, and leaves tiny objects alone.
• Write lifecycle rules for every bucket: transitions, expiry, noncurrent versions and incomplete multipart uploads.
• Mind the minimums. Infrequent-access classes bill at least 128 KB per object and 30 days, and Glacier classes have 90 or 180 day minimums.
• Cut request costs by batching small objects, caching with CloudFront and avoiding polling LIST calls.
• Keep traffic inside AWS. A gateway VPC endpoint is free, and moving data between S3 and EC2 in the same Region doesn’t cost transfer fees.
• Watch cross-Region replication and copy jobs. They bill for both transfer and the second copy.
• Delete what you don’t need: abandoned buckets, old logs, noncurrent versions, and test data.
• Compress and use efficient formats such as Parquet for analytics. You pay for every byte stored and scanned.
• Tag buckets by team and product, and set a budget alert for S3 as a line item.

• Keep Block Public Access on for the account, and treat any exception as a reviewed change.
• Give each application its own IAM role with permissions on one bucket or prefix. Don’t hand out long-lived access keys.
• Add a bucket policy that denies requests not using TLS, and, for internal data, requests that don’t come through your VPC endpoint.
• Rely on the default SSE-S3 encryption for most data, and use SSE-KMS with a customer-managed key where you need key-level control and logs.
• Switch on versioning, and add MFA delete or Object Lock where deletes must be hard to do.
• Share one object through a presigned URL that expires soon, and leave the bucket closed.
• Log with CloudTrail data events and server access logs for sensitive buckets, and send them to a separate account.
• Scan for exposure with IAM Access Analyzer for S3 and Amazon Macie to find sensitive data in the wrong place.
• Keep ACLs off (the bucket owner enforced setting) so policies are the only way access is granted.
• Review who can create buckets and change policies, and use service control policies to stop the dangerous actions across accounts.

Use AWS CloudTrail to see who changed a bucket or read an object, AWS Config for configuration history and rules, IAM Access Analyzer to find buckets shared outside the account, and AWS Artifact for compliance reports. S3 is in scope for many assurance programmes, but the duty is shared: AWS runs the service, and you own the policies, encryption choices, retention and data.

• Keep less. Data nobody needs still sits on disks that use electricity, so deleting it is the simplest saving there is.
• Compress files and prefer compact formats such as Parquet, so there is less to store, copy and scan.
• Use lifecycle rules and Intelligent-Tiering so cold data sits in the classes meant for it.
• Cache popular objects at the edge, so one copy at the origin serves many readers.
• Put buckets near the people and services that read them, which also shortens the long-haul transfers.
• For big archives that nobody waits on, a Region with a cleaner power grid is an easy pick.
• The AWS Customer Carbon Footprint Tool estimates emissions for your account. See how it treats S3 before you quote a figure.

Purchase options

What you actually pay for

• Storage, by class and by the GB-month
• Requests (PUT, GET, LIST and others), per thousand
• Fees for reading back from infrequent-access and Glacier classes, and charges for leaving them early
• Data transferred out to the internet or to another Region
• Features: Intelligent-Tiering monitoring, replication, inventory, Storage Lens advanced metrics, S3 Object Lambda and others

A private bucket for user uploads, set up as you’d want it in production: Block Public Access, versioning, encryption, a TLS-only policy and a lifecycle rule. Use the CLI or the Terraform tab to create the bucket. The Python and C# tabs put an invoice in it and hand back a link that stops working after 15 minutes. Swap in your own bucket name, Region and key.

# Names must be unique across AWS: change the bucket name. Mumbai is used as the example Region.
BUCKET=acme-uploads-123456789012
REGION=ap-south-1

aws s3api create-bucket --bucket $BUCKET --region $REGION \
  --create-bucket-configuration LocationConstraint=$REGION

# Nothing public, ever
aws s3api put-public-access-block --bucket $BUCKET --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

# Keep older versions so a bad overwrite can be undone
aws s3api put-bucket-versioning --bucket $BUCKET --versioning-configuration Status=Enabled

# SSE-S3 is already the default; stating it makes the intent visible
aws s3api put-bucket-encryption --bucket $BUCKET --server-side-encryption-configuration \
  '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"},"BucketKeyEnabled":true}]}'

# Refuse any request that is not sent over TLS
aws s3api put-bucket-policy --bucket $BUCKET --policy '{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyPlainHttp",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::'$BUCKET'", "arn:aws:s3:::'$BUCKET'/*"],
    "Condition": {"Bool": {"aws:SecureTransport": "false"}}
  }]
}'

# Cheaper class after 30 days, old versions gone after 90, unfinished uploads cleaned up after 7
aws s3api put-bucket-lifecycle-configuration --bucket $BUCKET --lifecycle-configuration '{
  "Rules": [{
    "ID": "age-out",
    "Status": "Enabled",
    "Filter": {"Prefix": ""},
    "Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"}],
    "NoncurrentVersionExpiration": {"NoncurrentDays": 90},
    "AbortIncompleteMultipartUpload": {"DaysAfterInitiation": 7}
  }]
}'

# Upload, then make a link that works for 15 minutes
aws s3 cp ./invoice-1042.pdf s3://$BUCKET/invoices/2026/10/invoice-1042.pdf
aws s3 presign s3://$BUCKET/invoices/2026/10/invoice-1042.pdf --expires-in 900

# Assumes var.bucket_name (globally unique) and the AWS provider version 4 or later
resource "aws_s3_bucket" "uploads" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_public_access_block" "uploads" {
  bucket                  = aws_s3_bucket.uploads.id
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "uploads" {
  bucket = aws_s3_bucket.uploads.id
  rule {
    object_ownership = "BucketOwnerEnforced"  # ACLs off
  }
}

resource "aws_s3_bucket_versioning" "uploads" {
  bucket = aws_s3_bucket.uploads.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "uploads" {
  bucket = aws_s3_bucket.uploads.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
    bucket_key_enabled = true
  }
}

data "aws_iam_policy_document" "tls_only" {
  statement {
    sid       = "DenyPlainHttp"
    effect    = "Deny"
    actions   = ["s3:*"]
    resources = [aws_s3_bucket.uploads.arn, "${aws_s3_bucket.uploads.arn}/*"]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

resource "aws_s3_bucket_policy" "uploads" {
  bucket     = aws_s3_bucket.uploads.id
  policy     = data.aws_iam_policy_document.tls_only.json
  depends_on = [aws_s3_bucket_public_access_block.uploads]
}

resource "aws_s3_bucket_lifecycle_configuration" "uploads" {
  bucket = aws_s3_bucket.uploads.id

  rule {
    id     = "age-out"
    status = "Enabled"

    filter {}

    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }
    noncurrent_version_expiration {
      noncurrent_days = 90
    }
    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }

  depends_on = [aws_s3_bucket_versioning.uploads]
}

# pip install boto3
import boto3
from botocore.config import Config

BUCKET = "acme-uploads-123456789012"
REGION = "ap-south-1"

# Signature version 4 is needed for presigned URLs in newer Regions
s3 = boto3.client("s3", region_name=REGION, config=Config(signature_version="s3v4"))


def upload_invoice(path, key):
    """Upload one file. upload_file switches to multipart on its own for large files."""
    s3.upload_file(
        path,
        BUCKET,
        key,
        ExtraArgs={
            "ContentType": "application/pdf",
            "ServerSideEncryption": "AES256",
            "Metadata": {"source": "billing-service"},
        },
    )


def download_link(key, seconds=900):
    """A URL that lets the holder fetch this one object until it expires."""
    return s3.generate_presigned_url(
        "get_object",
        Params={"Bucket": BUCKET, "Key": key},
        ExpiresIn=seconds,
    )


def list_prefix(prefix):
    """List keys under a prefix, page by page, so a large listing doesn't need one huge response."""
    keys = []
    for page in s3.get_paginator("list_objects_v2").paginate(Bucket=BUCKET, Prefix=prefix):
        keys.extend(item["Key"] for item in page.get("Contents", []))
    return keys


if __name__ == "__main__":
    key = "invoices/2026/10/invoice-1042.pdf"
    upload_invoice("invoice-1042.pdf", key)
    print(download_link(key))
    print(list_prefix("invoices/2026/10/"))

// Program.cs: put an invoice in the bucket and print a 15-minute download link
// NuGet package: AWSSDK.S3
using Amazon;
using Amazon.S3;
using Amazon.S3.Model;

const string bucket = "acme-uploads-123456789012";
const string key = "invoices/2026/10/invoice-1042.pdf";

// Credentials come from the usual chain: environment, shared profile or the role the code runs under
using var s3 = new AmazonS3Client(RegionEndpoint.APSouth1);

// Upload; PutObject suits files up to a few hundred megabytes, and TransferUtility handles larger ones in parts
var put = new PutObjectRequest
{
    BucketName = bucket,
    Key = key,
    FilePath = "invoice-1042.pdf",
    ContentType = "application/pdf",
    ServerSideEncryptionMethod = ServerSideEncryptionMethod.AES256
};
put.Metadata["source"] = "billing-service";
await s3.PutObjectAsync(put);

// A signed link that works until it expires
var link = s3.GetPreSignedURL(new GetPreSignedUrlRequest
{
    BucketName = bucket,
    Key = key,
    Verb = HttpVerb.GET,
    Expires = DateTime.UtcNow.AddMinutes(15)
});
Console.WriteLine(link);

// List what's under a prefix, one page at a time
string? token = null;
do
{
    var page = await s3.ListObjectsV2Async(new ListObjectsV2Request { BucketName = bucket, Prefix = "invoices/2026/10/", ContinuationToken = token });
    foreach (var item in page.S3Objects)
    {
        Console.WriteLine($"{item.Key}  {item.Size} bytes");
    }
    token = page.IsTruncated == true ? page.NextContinuationToken : null;
} while (token is not null);

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

The same job does not always need object storage. A shared file system for servers is Amazon EFS or FSx territory, and a block disk for one server is Amazon EBS. If the data is mostly rows you query, a database or a warehouse is a better home.