S3: Buckets, Storage Classes, Security & Presigned URLs

In one line

S3 stores objects (files plus metadata) in buckets with eleven nines of durability; storage classes and lifecycle rules control cost, Block Public Access and bucket policies control exposure, and presigned URLs let clients upload or download directly without your server in the middle.

0/4 · 0%

Think of it like this

A giant, extremely reliable warehouse with labelled boxes. You don't get a 'disk' — you hand over a box with a label (the KEY, like invoices/2026/09/123.pdf) and ask for it back by that label later. Cheaper back-rooms (storage classes) exist for boxes you rarely need.

Key ideas

01
S3 is OBJECT storage, not a filesystem: you PUT and GET whole objects (up to 5 TB; use multipart upload above ~100 MB), there's no appending or editing in place, and 'folders' are just key prefixes. It is strongly read-after-write consistent.
02
STORAGE CLASSES trade retrieval cost/latency for storage price: Standard (hot), Standard-IA and One Zone-IA (infrequent access, retrieval fee), Glacier Instant/Flexible/Deep Archive (archival, cheapest, minutes-to-hours retrieval for the deeper tiers), and Intelligent-Tiering (moves objects automatically by access pattern — a good default when you don't know). LIFECYCLE RULES transition or expire objects by age or prefix.
03
SECURITY: keep BLOCK PUBLIC ACCESS on at the account level (it overrides any policy or ACL that would make data public), disable ACLs (Object Ownership = bucket owner enforced), and control access with IAM and bucket policies (Phase 1). All new objects are encrypted at rest by default (SSE-S3); use SSE-KMS when you need key-level access control and audit (Phase 7).
04
PRESIGNED URLs are time-limited URLs signed with your credentials that allow one specific operation on one specific key. Your API generates one; the browser or mobile client uploads straight to S3. Your server never handles the bytes, which removes bandwidth, memory, and timeout problems for large files.
05
VERSIONING keeps every version of every object, protecting against accidental overwrites and deletes (a delete becomes a 'delete marker'). Pair it with a lifecycle rule to expire old versions, or costs grow silently. Serve public assets through CloudFront (Phase 7) rather than a public bucket.

Code & diagrams

s3-basics.shbash

aws s3api create-bucket --bucket acme-uploads-prod \
  --create-bucket-configuration LocationConstraint=ap-south-1
aws s3api put-public-access-block --bucket acme-uploads-prod \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
aws s3api put-bucket-versioning --bucket acme-uploads-prod \
  --versioning-configuration Status=Enabled

aws s3 cp report.pdf s3://acme-uploads-prod/reports/2026/report.pdf
aws s3 sync ./build s3://acme-static-site/ --delete

# Presigned download link valid for 10 minutes
aws s3 presign s3://acme-uploads-prod/reports/2026/report.pdf --expires-in 600

lifecycle.jsonjson

{
  "Rules": [
    {
      "ID": "logs-to-archive",
      "Filter": { "Prefix": "logs/" },
      "Status": "Enabled",
      "Transitions": [
        { "Days": 30, "StorageClass": "STANDARD_IA" },
        { "Days": 90, "StorageClass": "GLACIER" }
      ],
      "Expiration": { "Days": 365 }
    },
    {
      "ID": "trim-old-versions",
      "Filter": {},
      "Status": "Enabled",
      "NoncurrentVersionExpiration": { "NoncurrentDays": 30 },
      "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
    }
  ]
}

PresignedUploaddiagram

Rendering diagram…

Explain it without notes

Why are presigned uploads better than streaming files through your API server?

What does Block Public Access protect against that a carefully written bucket policy doesn't?

Practice

Logs are written daily, read often for a week, rarely after a month, and must be kept for a year. Design a lifecycle policy.

A user deleted an important file from a versioned bucket. How do you get it back?

Trade-offs

↔
Colder storage classes cut storage cost sharply but add retrieval fees, minimum storage durations, and (for Glacier tiers) retrieval delays — moving data that turns out to be read often can cost more than leaving it in Standard. Intelligent-Tiering is the safe choice when access patterns are unknown.

Done when you can

I keep Block Public Access on and ACLs disabled.
I can write a lifecycle rule including version and multipart cleanup.
I use presigned URLs for client uploads and downloads.
I can recover a deleted object from a versioned bucket.