Amazon Simple Storage Service
Unlimited object storage
Stores objects (any file plus metadata) in buckets, with unlimited capacity and 11 nines of durability, accessed over an HTTP API.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?A little
- Serverless
- In examsCLF · SAA · DVA · SOA
Think of it asLike an endless coat check: hand in an item, get a ticket (key) for it, and use the ticket to get it back.
Where does S3 fit?
Calls S3
S3S3 calls
A real example, step by step
- A learning app lets students upload assignments as PDFs and videos.
- The app creates a presigned URL so the browser uploads files straight to the S3 bucket, without going through your server.
- Each new file triggers Lambda to create a preview image; CloudFront delivers videos quickly to students everywhere.
- A lifecycle rule moves files older than 90 days to S3 Glacier, much cheaper than the Standard class.
- The bucket stays private (Block Public Access is on by default), and versioning keeps old copies if someone deletes or overwrites a file by mistake.
When to use it
✓ Use it when
Images, videos, backups, static website files, data lakes.
✗ Avoid it when
You need a disk to install an operating system/DB → EBS; you need a shared NFS folder → EFS.
Common uses
- Store user images, videos and documents
- Static website hosting (with CloudFront)
- Backups and long-term archiving (Glacier classes)
- Data lake for Athena, Glue, EMR
S3, EBS or EFS?
| S3 |  EBS |  EFS | |
|---|---|---|---|
| Storage type | Objects over an API/HTTP | A disk attached to one machine | A shared NFS folder |
| Who can use it | Anyone with permission, from anywhere | One EC2 instance in the same AZ | Many Linux machines at once |
| Capacity | Practically unlimited | Chosen up front, can grow | Grows with your data |
| Best for | Files, images, backups, data lakes | Operating systems, databases | A folder shared by many machines |
What does it cost?
- Pricing model: Per GB-month depending on storage class (Standard ~$0.023/GB) + requests (PUT ~$0.005/1,000, GET ~$0.0004/1,000) + data transfer out to the Internet.
- Free tier: 100 GB of data transfer out to the Internet free per month (shared across all services). Older accounts: plus 5 GB of Standard for 12 months.
Data transfer out to the Internet (~$0.09/GB) — put CloudFront in front; millions of small files drive up request costs; versioning keeps every old version; deleting early from Glacier/IA is still billed for the minimum storage duration.
“Cheapest for rarely accessed data” → the right storage class plus a lifecycle rule; “block direct access to the bucket” → CloudFront with Origin Access Control; “EC2 writes to S3 without the internet” → a gateway VPC endpoint.
Try real exam questions
1A company is designing a website that will be hosted on Amazon S3. How should users be prevented from linking directly to the assets in the S3 bucket?
- ACreate a static website, then update the bucket policy to require users to access the resources with the static website URL.
- BCreate an Amazon CloudFront distribution with an origin access control (OAC) and update the bucket policy to grant permission to the OAC only.
- CCreate a static website, then configure an Amazon Route 53 record set with an alias pointing to the static website. Provide this URL to users.
- DCreate an Amazon CloudFront distribution with an AWS WAF web ACL that permits access to the origin server through the distribution only.
Show answer
Correct answer: B
Put CloudFront in front of the bucket with Origin Access Control (OAC), and let the bucket policy allow only the OAC to read. Users can't reach the bucket directly; they have to go through CloudFront.
2A company is planning to use Amazon S3 to store images uploaded by its users. The images must be encrypted at rest in Amazon S3. The company does not want to spend time managing and rotating the keys, but it does want to control who can access those keys. What should a solutions architect use to accomplish this?
- AServer-Side Encryption with encryption keys stored in an S3 bucket
- BServer-Side Encryption with Customer-Provided Keys (SSE-C)
- CServer-Side Encryption with encryption keys stored in AWS Systems Manager Parameter Store
- DServer-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
Show answer
Correct answer: D
SSE-KMS uses keys in KMS: AWS stores and rotates the keys, while you control who can use them with key policies and IAM. SSE-C makes you manage keys yourself; keys don't belong in a bucket or Parameter Store.
Frequently asked questions
Which S3 storage class should I choose?
Standard for frequently used data; Intelligent-Tiering when you can't predict access patterns; Standard-IA and One Zone-IA for infrequently accessed data; the Glacier classes for long-term archiving, where cheaper classes are slower to retrieve and charge retrieval fees.
Are S3 buckets public on the internet?
Not by default. Block Public Access is on and new buckets are accessible only to their owner. To share files safely, use presigned URLs or put CloudFront in front instead of making the bucket public.
What do AWS exams ask about S3?
Storage classes and lifecycle rules, versioning, encryption (SSE-S3, SSE-KMS), bucket policies and Block Public Access, cross-region replication, presigned URLs, S3 Transfer Acceleration and multipart upload for large files.