Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Object storage for any amount of data: files kept as objects in buckets, designed for eleven nines of durability, and private until you grant access.
Where S3 takes you6 steps, all open
Amazon S3 stores data as objects in buckets. An object is a file and the metadata that describes it, found by its key, such as photos/puppy.jpg, in a bucket you create in one Region. A bucket holds any number of objects, and one object can be up to 50 TB.
Durable, and private by default. Every storage class except the two One Zone classes keeps data across at least three Availability Zones, designed for eleven nines of durability. Buckets and objects are private until you grant access, and every new object is encrypted.
Hand over a coat and you get a ticket; the coat is kept safe in the back, in several rooms at once. Show the ticket and you get the coat. You can ask the cloakroom to keep every coat ever handed in under the same ticket, to move coats nobody collects to cheaper storage, or to give a friend a signed pass that works until tonight.
BucketKeyObjectVersioningLifecyclePresigned URLWould any Block Public Access setting on the account or the bucket stop the access this request relies on?
Does an IAM policy or the bucket policy allow it, with no explicit deny? Nothing is allowed until something grants it.
An object encrypted with SSE-KMS also needs permission to use its KMS key.
Is there a current version to return? In a versioned bucket, a delete leaves a delete marker on top.
Pick a case to follow the request through each check.
The bucket stays private behind CloudFront. Origin access control lets the distribution read it, while the S3 website endpoint serves only publicly readable content, over HTTP and never HTTPS.
Uploads start work. An event notification can invoke a Lambda function, or go to an SQS queue, an SNS topic or EventBridge, each time an object is created.
Private instances reach S3 without the internet. A gateway endpoint in the VPC's route tables sends their S3 traffic privately, at no charge.
S3 scales to high request rates by itself: at least 3,500 writes or 5,500 reads a second for each partitioned prefix, with no limit on how many prefixes a bucket has. Spread the keys over more prefixes and the rate multiplies; ten prefixes can serve 55,000 reads a second.
Capacity: 5,500 reads a second for each.
1,000 reads a second more than 2 prefixes can take. Add 1 more, or shed the load.
Scaling up takes a moment. While S3 grows to a new rate, you may see a few 503 Slow Down errors. They stop once it has scaled.
Big files in parts. Multipart upload sends the parts of one object in parallel and in any order; a single PUT stops at 5 GB.
Far-away uploads. Transfer Acceleration takes uploads in at the nearest CloudFront edge location and carries them to the bucket over an optimised network path.
Block Public Access stays on. It is on by default for new buckets and overrides any policy or ACL that would make data public. AWS recommends turning all four settings on for the whole account.
Policies, not ACLs. New buckets have ACLs disabled, with the bucket owner owning every object, and access is granted with IAM and bucket policies.
Encryption. Every new object is encrypted with SSE-S3 by default. Choose SSE-KMS or DSSE-KMS for keys you control and audit, SSE-C to send your own key with each request, or encrypt on the client before uploading.
Versioning, MFA delete and Object Lock. Versioning keeps every version, so a delete only adds a delete marker. MFA delete asks for an MFA code to delete a version or change versioning, and only the bucket owner's root user can turn it on. Object Lock stops versions being overwritten or deleted for a set time.
Presigned URLs hand out time-limited access with the permissions of whoever signed them, so treat each one like a key.
Storage by the GB-month, set by the storage class, with minimum durations and minimum object sizes in the IA and Glacier classes.
Requests and retrievals: a charge for each request, and for each GB retrieved from the IA and Glacier classes.
Data transfer out. Data coming in from the internet is free.
Every version is a whole object. Three versions of a file are charged as three objects.
Replication adds the destination's storage and requests and the transfer between Regions; Same-Region Replication has no transfer charge.
Lifecycle and Intelligent-Tiering cut the bill as data cools. Intelligent-Tiering adds a small monitoring charge for each object, but no retrieval charges.
Prices change, so none are printed here. Check the S3 pricing page on aws.amazon.com.
| Class | Zones | Minimum duration | Retrieval | Choose it when |
|---|---|---|---|---|
| S3 Standard | At least 3 | None | Milliseconds, no fee | Data read often |
| S3 Intelligent-Tiering | At least 3 | None | Milliseconds, no retrieval fees | Access unknown or changing |
| S3 Standard-IA | At least 3 | 30 days | Milliseconds, a fee per GB | Read about once a month, and cannot be recreated |
| S3 One Zone-IA | 1 | 30 days | Milliseconds, a fee per GB | Data you can recreate, such as replicas |
| S3 Express One Zone | 1 | None | Single-digit milliseconds | The lowest latency, next to your compute |
| S3 Glacier classes | At least 3 | 90 or 180 days | Milliseconds to 48 hours | Archives: see S3 Glacier |
| Replication | What it copies | Choose it when |
|---|---|---|
| Cross-Region Replication | New objects, to a bucket in another Region | Compliance distance, or users far from the source |
| Same-Region Replication | New objects, to a bucket in the same Region | Gathering logs, or copies in another account |
| Batch Replication | Existing objects, on demand | Objects from before replication, or ones that failed |
| Replication Time Control | 99.99 percent of new objects within 15 minutes | A replication time backed by an SLA |
make sure no bucket is ever made public by mistakeS3 Block Public Access, for the whole account
It overrides any policy or ACL that would grant public access.
recover objects deleted or overwritten by mistakeVersioning
A delete adds a delete marker, and every earlier version can be restored.
copy new objects to another Region automaticallyCross-Region Replication
It needs versioning on both buckets. Batch Replication copies the objects that were there before.
records must not be changed or deleted for seven years, by anyoneObject Lock in compliance mode
Not even the root user can shorten the retention period.
let someone download one private object for an hour, without changing any policyA presigned URL
It carries the signer's permissions until it expires.
upload a 20 GB fileMultipart upload
A single PUT takes at most 5 GB.
customers around the world upload to one bucket, slowlyTransfer Acceleration
Uploads enter at the nearest CloudFront edge location and travel on an optimised path.
a static website on S3 must be served over HTTPSPut CloudFront in front
S3 website endpoints do not support HTTPS.
access patterns are unknown, and retrieval charges must be avoidedS3 Intelligent-Tiering
It moves objects between tiers by itself, with no retrieval fees.
private instances must reach S3 without a NAT gatewayA gateway endpoint
It routes S3 traffic privately from the route tables, at no charge.
A company stores monthly reports in S3. They are read often for 30 days and rarely for the rest of the year, and then must be kept for 7 more years for auditors, who can wait 48 hours for one. Reports that are deleted or overwritten by mistake must be recoverable. What should a solutions architect do?
A phone app uploads photos with presigned URLs. The storage must hold an unknown and growing number of photos, designed for eleven nines of durability, and a function must make a thumbnail as each photo arrives. Where are the photos stored?
50 TB each.3,500 writes and 5,500 reads a second, per prefix.5 GB: multipart. From far away: Transfer Acceleration.15 minutes.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Next: S3 GlacierThree S3 storage classes for archives: Instant Retrieval, read in milliseconds; Flexible Retrieval, restored in minutes to hours; and Deep Archive, the lowest cost, restored within 12 to 48 hours.
Open S3 GlacierEvery fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.