Amazon S3
Amazon Simple Storage Service
Overview
Amazon S3 stores files (objects) with virtually unlimited capacity in containers called buckets — accessed via HTTP/HTTPS API from anywhere. Designed for 99.999999999% (eleven nines) durability by redundantly storing data across multiple facilities. Broad use cases: static website hosting, backup and disaster recovery, data lakes for analytics, log aggregation, and media delivery origin. Many AWS services use S3 as their data store.
Key Concepts
Storage Classes
Standard for frequent access; Standard-IA and One Zone-IA for infrequent access at lower cost; Intelligent-Tiering for automatic tier management; Glacier variants for archival. Each class differs in storage price, retrieval fee, and retrieval time — matching access frequency and retrieval speed requirements to the right class is the key to cost optimization.
Lifecycle Policies
Automatically transition objects to cheaper classes (e.g., Standard → IA after 30 days → Glacier after 90 days) or delete them based on age. Ideal for logs and backups that lose value over time — lifecycle policies handle cost reduction without manual work.
Versioning and Object Lock
Versioning preserves prior versions on overwrite or delete, enabling recovery from accidental changes or ransomware. Deletion only adds a delete marker; the data remains. Object Lock adds WORM (Write Once Read Many) protection for compliance retention requirements.
Encryption
Server-side encryption options: SSE-S3 (S3-managed keys), SSE-KMS (KMS-managed keys with audit and key policy control), SSE-C (customer-provided keys). New objects are encrypted by default. Transfer is protected by HTTPS. Bucket policies can deny uploads that are not encrypted.
Access Control
IAM policies, bucket policies, and ACLs control access — current best practice is to disable ACLs and manage via IAM. Block Public Access settings are enabled by default to prevent accidental exposure. Pre-signed URLs allow temporary, limited public access for specific objects.
Typical Use Cases
- Host static websites or SPA assets and serve them via CloudFront globally
- Store database and EC2 backups and snapshots for long-term retention
- Aggregate logs into a data lake and query directly with analytics services
- Auto-tier old data to Glacier via lifecycle to minimize archive costs
- Use pre-signed URLs to allow per-user time-limited uploads and downloads
Exam Relevance
S3 is one of the highest-density topics in SAA, DVA, and SOA. SAA features storage class selection questions: 'millisecond access but unpredictable patterns → Intelligent-Tiering,' 'single AZ low cost → One Zone-IA,' 'hours-delayed archive → Glacier.' Private subnet access without internet uses Gateway VPC endpoint. SOA covers lifecycle, versioning, and replication (CRR/SRR). DVA tests pre-signed URLs and encryption methods (SSE-KMS vs. SSE-S3). Reading 'durability/availability/retrieval speed/cost' trade-offs from requirements is the core scoring skill.
Related Services
References
Last updated: 2026-06-24
This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.