Amazon S3

What it is

Amazon Simple Storage Service (Amazon S3) is object storage. You store objects (a file plus its metadata) in buckets, and reach them over HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry through the S3 API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, the console, the CLI, or the SDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entry. S3 scales without limit on the number of objects, and you pay only for what you store and use.

Choose S3 for Data lakeA central store for large amounts of structured and unstructured data kept in its original form, usually in Amazon S3, which many tools can analyze. AWS Lake Formation helps build and secure one.Glossary entry, backups and archives, static website content, media, logs, and any data that applications read and write as whole objects. For a disk attached to one EC2 instance, use Amazon EBS; for a shared file system with file locking and POSIX semantics, use Amazon EFS or Amazon FSx.

Concepts

Buckets: a bucket lives in one AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry. General purpose bucket names are unique across all AWS accounts in a partition, unless you create the bucket in your account regional namespace, a reserved part of the namespace (names end with your account ID, Region, and -an). By default, an account can create 10,000 general purpose buckets, and you can request more.
Objects and keys: each object has a key (its name, such as reports/2026/q1.csv). There are no real folders: the /-separated part of the key, the prefix, groups objects.
Object size: up to 50 TB (48.8 TiB) per object, through multipart upload (parts of 5 MiB to 5 GiB, up to 10,000 parts). A single PUT uploads up to 5 GB, and the console up to 160 GB. Older material says 5 TB, the previous limit.
Consistency: S3 gives strong read-after-write consistency for PUTs and DELETEs in all Regions, so a read right after a write returns the new data.
Other bucket types: directory buckets for S3 Express One Zone, table buckets (S3 Tables, Apache Iceberg tables for analytics), and vector buckets (S3 Vectors).

Storage classes

All classes are designed for 99.999999999% (11 nines) durability. They differ in availability, AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry, minimum storage duration, and retrieval fees.

Class	Designed for	Availability	AZs	Minimum duration	Notes
S3 Standard	Frequently accessed data	99.99%	3 or more	None	The default
S3 Intelligent-Tiering	Unknown or changing access patterns	99.9%	3 or more	None	Moves objects between tiers automatically; per-object monitoring fee, no retrieval fees
S3 Standard-IA	Infrequent access, millisecond retrieval	99.9%	3 or more	30 days	128 KB minimum billable size; per-GB retrieval fee
S3 One Zone-IA	Re-creatable infrequent data	99.5%	1	30 days	Lost if the Availability Zone is destroyed
S3 Express One Zone	Single-digit millisecond LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry	99.95%	1, you choose	None	Directory buckets; up to 10x faster than S3 Standard
S3 Glacier Instant Retrieval	Archives read about once a quarter, in milliseconds	99.9%	3 or more	90 days	128 KB minimum billable size
S3 Glacier Flexible Retrieval	Archives read about once a year, minutes to hours	99.99% after restore	3 or more	90 days	Restore before reading; free bulk retrievals
S3 Glacier Deep Archive	Lowest-cost archive, hours	99.99% after restore	3 or more	180 days	Restore within 12 hours (standard) or 48 hours (bulk)

Intelligent-Tiering moves an object to Infrequent Access after 30 days without access and to Archive Instant Access after 90 days, and moves it back to Frequent Access as soon as it is read. You can also turn on the optional Archive Access (90 days or more) and Deep Archive Access (180 days or more) tiers, which need a restore before reading. Objects under 128 KB stay in the Frequent Access tier. Reduced Redundancy Storage still exists but is not recommended. See the S3 Glacier tutorial for archive retrieval.

Managing data

Versioning keeps every version of an object, so you can recover from overwrites and deletes (a delete adds a delete marker). A bucket starts unversioned; once enabled, versioning can be suspended but never turned off. Each version is billed as a full object.
MFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entry delete requires an MFA code to delete a version or change the versioning state. Only the bucket owner (root user) can enable it.
S3 Lifecycle rules transition objects to cheaper classes and expire them (including incomplete multipart uploads). For a versioned bucket, a noncurrent version expiration deletes old versions a set number of days after they become noncurrent, which caps versioning cost while keeping a recovery window. Transitions follow a waterfall, from warmer to colder classes. By default, objects under 128 KB are not transitioned, and moving or deleting an object before its minimum duration is charged for the rest of it.
Replication copies objects asynchronously to other buckets, in another Region (Cross-Region Replication, CRR) or the same Region (Same-Region Replication, SRR), and across accounts. Both buckets need versioning. Live replication covers new objects only; use S3 Batch Replication for existing ones (and to retry failed or re-replicate objects). It runs as a Batch Operations job on the existing replication rule and gives a completion report that shows success or failure for each object. S3 Replication Time Control (RTC) replicates 99.9% of objects within 15 minutes, backed by an SLA (Service level agreement)A provider's commitment to a level of service, such as a monthly uptime percentage, and what customers receive if it is missed, usually service credits.Glossary entry, and adds replication metrics and events for objects that miss the threshold.
Event notifications send object events (created, removed, restored, and more) to SNS, SQS, Lambda, or EventBridge. SQS FIFO (First in, first out)Processing items in the order they arrived. Amazon SQS FIFO queues keep messages in order within a message group and remove duplicates.Glossary entry queues aren't a direct destination; route through EventBridge.
S3 Batch Operations runs one action (copy, tag, restore, invoke Lambda, and more) on billions of objects from a manifest or an S3 Inventory report.
S3 Object Lock stores versions as write-once-read-many (WORM (Write once, read many)A storage model in which data can be written once and then cannot be changed or deleted for a set period, often to meet record-keeping rules. Amazon S3 Object Lock and AWS Backup Vault Lock provide it.Glossary entry) for a retention period or under a legal hold. In compliance mode, nobody, including the root user, can delete or overwrite a locked version or shorten its retention. In governance mode, only users with the s3:BypassGovernanceRetention permission can. See encryption keys and data retention.

S3 replication. A source bucket in Region A, with versioning on, copies new objects asynchronously to a bucket in the same Region with Same-Region Replication and to a bucket in Region B with Cross-Region Replication. Both destination buckets also have versioning on.

An example S3 Lifecycle rule. Objects start in S3 Standard, move to S3 Standard-IA after 30 days, to Glacier Flexible Retrieval after 90 days, and to Glacier Deep Archive after one year, and expire after seven years. Each step moves to a colder, cheaper class.

Security, resilience, performance, and cost

Security

Block Public Access: new buckets, access points, and objects don't allow public access, and the four Block Public Access settings are on. Apply them at the account or organization level so a bucket policy can't open a bucket.
Object Ownership: the default, Bucket owner enforced, disables ACL (Access control list)A list attached to a resource that names who may access it and what they may do. VPC subnets have network ACLs; Amazon S3 buckets also support ACLs, but new buckets disable them in favor of policies.Glossary entry, so the bucket owner owns every object and access is controlled by policies only.
Policies: use IAM policies for your own PrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entry and bucket policies (resource-based) for cross-account access, conditions such as aws:SourceVpce, or forcing TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry with aws:SecureTransport. A bucket policy that denies all requests unless aws:SourceVpce matches one endpoint blocks every other path, whatever IAM allows.
Cross-account access needs both sides: the bucket owner's bucket policy must allow the other account's principal, and that principal's identity policy in its own account must allow the action. For SSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entry-KMS objects, the KMS key policy must also allow the principal.
Access points give each application or team its own hostname and access point policy for a shared dataset, and can accept requests only from a VPC.
Presigned URLA URL that lets anyone who has it download or upload one specific S3 object for a limited time, using the permissions of the identity that created it.Glossary entry give time-limited access to one object without AWS credentials. They carry the creator's permissions, last up to 7 days, and stop working earlier if the creator's temporary credentials expire.
Encryption: every new object is encrypted at rest with SSE-S3 by default (since January 5, 2023). Choose SSE-KMS with a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry when you must control the key policy, revoke access by disabling the key, and audit each use in CloudTrail; DSSE-KMS for two layers; or encrypt client-side. S3 Bucket Keys cut SSE-KMS request costs (by up to 99%) by using a short-lived bucket-level key instead of calling KMS for every object, with no application change; they don't work with DSSE-KMS. See encryption keys and data retention.
Private access from a VPC: a VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry for S3 adds a route to your route table at no additional charge, but works only from that VPC in the same Region. From On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry, peered VPCs in other Regions, or through a transit gateway, use an interface endpoint (AWS PrivateLink), which is charged.
IAM Access Analyzer for S3 reports buckets shared publicly or with other accounts.

Resilience

Every class except One Zone-IA and Express One Zone stores data across at least three Availability Zones.
Versioning, MFA delete, and Object Lock protect against mistakes and deletion; CRR keeps a copy in another Region for DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry.
Multi-Region Access Points give one global endpoint that routes requests over AWS Global Accelerator to the nearest bucket among replicated buckets in several Regions, with FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry controls to move traffic away from a Region within minutes.

Performance

S3 supports at least 3,500 PUT/COPY/POST/DELETE and 5,500 GET/HEAD requests per second per partitioned prefix, with no limit on prefixes. If one prefix gets more, S3 returns HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry 503 Slow Down; spread keys across prefixes (for example, a device ID early in the key) to scale further.
Use multipart upload for objects of 100 MB or more (parallel parts, retry only failed parts) and byte-range fetches to download in parallel.
S3 Transfer Acceleration routes uploads and downloads through CloudFront Edge locationAn AWS site in a city, separate from the Regions, where Amazon CloudFront caches content close to users. Route 53, AWS WAF, AWS Shield, and AWS Global Accelerator also use the edge network, which has hundreds of locations.Glossary entry for faster long-distance transfers, at an extra charge.
Amazon CloudFront caches content near users; S3 Express One Zone gives the lowest latency next to your compute.

Cost

You pay for storage (per GB-month, by class), requests, retrievals (IA and Glacier classes), and data transfer out.
Free: data transfer in from the internet, transfer between S3 buckets or to other AWS services in the same Region, transfer out to CloudFront, and the first 100 GB per month out to the internet (across AWS services).
Requester Pays makes the requester pay for requests and downloads, while the owner still pays for storage. Anonymous requests aren't allowed.
Save with lifecycle rules, Intelligent-Tiering for unknown patterns, Storage Class Analysis, and expiring incomplete multipart uploads.

Monitoring

CloudWatch daily storage metrics are free; request metrics (1-minute) are opt-in and charged.
AWS CloudTrail records bucket-level management events; object-level data events must be turned on and are charged.
Server access logs record each request, delivered on a best-effort basis within hours.
S3 Storage Lens shows usage and activity across accounts and Regions, with free and paid advanced metrics; S3 Inventory lists objects and their encryption and replication status.

Static website hosting

A general purpose bucket can serve a static website from its website endpoint, with index and error documents and redirects. Website endpoints support HTTP only, not HTTPS or access points. For HTTPS and a custom domain, put CloudFront in front with an ACM certificate and OAC (Origin access control)The recommended way to let a CloudFront distribution read from a private S3 bucket: CloudFront signs its requests, and the bucket policy allows only that distribution. It replaces the older origin access identity (OAI).Glossary entry (OAC) and keep the bucket private (CloudFront is required if objects use SSE-KMS), or use AWS Amplify Hosting. A web app on another domain that calls S3 from the browser needs a CORS configuration on the bucket.

Availability changes

S3 Select (SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry filtering of one object) is no longer available to new customers; use Amazon Athena or filter in your application.
S3 Object Lambda (code that transforms GET, LIST, and HEAD responses) has been available only to existing customers since November 7, 2025.

Reverse mindmap: when the question points here

Is it Amazon S3?

Yes, when the question says
- Durable, unlimited object storage leads to Amazon S3
- Data lake for Athena, EMR, or Redshift Spectrum leads to Amazon S3
- Static website files leads to S3 behind CloudFront
Pick the storage class
- Unknown or changing access patterns leads to S3 Intelligent-Tiering
- Read monthly, millisecond access leads to S3 Standard-IA
- Re-creatable infrequent data, lowest IA cost leads to S3 One Zone-IA
- Archive read quarterly, in milliseconds leads to S3 Glacier Instant Retrieval
- Archive restored in minutes to hours leads to S3 Glacier Flexible Retrieval
- Cheapest archive, hours to restore leads to S3 Glacier Deep Archive
- Single-digit millisecond latency next to compute leads to S3 Express One Zone
Protect the data
- Recover overwritten or deleted objects leads to Versioning
- Nobody can delete before a date leads to Object Lock compliance mode
- Only a few approved users can delete early leads to Object Lock governance mode
- Copy to another Region for DR leads to Cross-Region Replication
- Copy objects that existed before the replication rule leads to S3 Batch Replication
- Replication within a predictable 15 minutes leads to S3 RTC
- Stop any bucket becoming public leads to Account-level Block Public Access
Share and connect
- Temporary download link without credentials leads to Presigned URL
- Many teams, one dataset, separate policies leads to Access points
- Another account reads the bucket leads to Bucket policy plus the caller's IAM policy
- Private access from a VPC at no charge leads to Gateway endpoint
- Private access from on premises leads to Interface endpoint
- React to new uploads leads to Event notification to Lambda, SQS, SNS, or EventBridge
Make it fast or cheap
- Faster uploads from far away leads to Transfer Acceleration
- Large files leads to Multipart upload
- Move or delete old data automatically leads to Lifecycle rules
- Downloader pays for transfer leads to Requester Pays
- Lower SSE-KMS request cost leads to S3 Bucket Keys

Key takeaways

S3 stores objects up to 50 TB in Regional buckets, with 11 nines of durability and strong read-after-write consistency.
Storage classes trade availability, retrieval time, and minimum duration for lower storage cost; Intelligent-Tiering automates the choice.
Versioning (never turned off once enabled), lifecycle rules, replication (needs versioning; RTC for 15 minutes), and Object Lock manage and protect data.
Block Public Access and Bucket owner enforced are on by default; use bucket policies, access points, presigned URLs, and gateway endpoints for controlled access.
Requests scale to 3,500 writes and 5,500 reads per second per prefix; website endpoints are HTTP only, so use CloudFront for HTTPS.