AWS for DevOps — S3 Basics

5.1 — S3 Basics

S3 (Simple Storage Service) is an object store with virtually unlimited capacity. You store files (objects) in containers (buckets). Every object has a key (path), metadata, and the data itself.

Core Concepts

Concept	Description
Bucket	Container for objects — globally unique name
Object	A file + metadata — up to 5 TB
Key	The full path of the object (e.g., artefacts/v1.2.3/app.tar.gz)
Region	Bucket is created in a specific region
Durability	99.999999999% (11 nines) — designed to never lose data
Availability	99.99% for Standard class

Creating a Bucket

$ aws s3 mb s3://my-devops-artefacts-2026 --region ap-south-1
make_bucket: my-devops-artefacts-2026

# Bucket names must be:
# - Globally unique across ALL AWS accounts
# - 3-63 characters, lowercase, no underscores
# - Start with a letter or number

Uploading and Downloading Objects

# Upload a file
$ aws s3 cp build/app-v1.2.3.tar.gz s3://my-devops-artefacts-2026/releases/v1.2.3/
upload: build/app-v1.2.3.tar.gz to s3://my-devops-artefacts-2026/releases/v1.2.3/app-v1.2.3.tar.gz

# Download a file
$ aws s3 cp s3://my-devops-artefacts-2026/releases/v1.2.3/app-v1.2.3.tar.gz .

# Sync an entire directory
$ aws s3 sync ./build/ s3://my-devops-artefacts-2026/builds/latest/

# List objects
$ aws s3 ls s3://my-devops-artefacts-2026/releases/
                           PRE v1.2.2/
                           PRE v1.2.3/

# Remove an object
$ aws s3 rm s3://my-devops-artefacts-2026/releases/v1.2.2/app-v1.2.2.tar.gz

# Remove all objects with a prefix
$ aws s3 rm s3://my-devops-artefacts-2026/releases/v1.2.2/ --recursive

Storage Classes

S3 offers different storage classes for different access patterns:

Class	Access	Cost	Use Case
Standard	Frequent	Highest	Active artefacts, recent logs
Standard-IA	Infrequent	Lower storage, retrieval fee	Backups older than 30 days
One Zone-IA	Infrequent, 1 AZ	Even lower	Reproducible data
Glacier Instant	Rare, ms retrieval	Very low	Compliance archives
Glacier Flexible	Rare, minutes-hours	Very low	Long-term archives
Glacier Deep Archive	Very rare, 12-48h	Lowest	7-year retention
Intelligent-Tiering	Unknown pattern	Small monitoring fee	When you’re not sure

Bucket Policies

A bucket policy is a resource-based policy (JSON) attached to the bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCodeBuildRead",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/CodeBuildRole"
      },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-devops-artefacts-2026",
        "arn:aws:s3:::my-devops-artefacts-2026/*"
      ]
    }
  ]
}

$ aws s3api put-bucket-policy \
    --bucket my-devops-artefacts-2026 \
    --policy file://bucket-policy.json

Block Public Access

By default, new buckets block all public access. Keep it that way for artefact and log buckets:

$ aws s3api put-public-access-block \
    --bucket my-devops-artefacts-2026 \
    --public-access-block-configuration \
        'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'

Server-Side Encryption

# Enable default encryption (SSE-S3)
$ aws s3api put-bucket-encryption \
    --bucket my-devops-artefacts-2026 \
    --server-side-encryption-configuration '{
        "Rules": [{
            "ApplyServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
            },
            "BucketKeyEnabled": true
        }]
    }'

Encryption Type	Key Management	Cost
SSE-S3 (AES256)	AWS manages keys	Free
SSE-KMS	AWS KMS key (you control)	KMS request charges
SSE-C	You provide the key	Free (you manage keys)

Common Mistakes

Mistake	Why It Hurts	Fix
Making a bucket public for “testing”	Data breach risk	Use presigned URLs or IAM
Not enabling versioning	Accidental deletes are permanent	Enable versioning (next section)
Storing everything in Standard class	Paying full price for rarely accessed data	Use lifecycle policies
Bucket names with dots	SSL certificate issues	Use hyphens, not dots

Quick Reference

Task	Command
Create bucket	aws s3 mb s3://BUCKET --region REGION
Upload file	aws s3 cp FILE s3://BUCKET/KEY
Download file	aws s3 cp s3://BUCKET/KEY FILE
Sync directory	aws s3 sync DIR s3://BUCKET/PREFIX/
List objects	aws s3 ls s3://BUCKET/PREFIX/
Delete object	aws s3 rm s3://BUCKET/KEY
Set bucket policy	aws s3api put-bucket-policy --bucket BUCKET --policy file://policy.json

---

Next → S3 Versioning & Lifecycle