S3Amazon Simple Storage Service

Amazon S3 stores data as objects in buckets. An object is a file and the metadata that describes it, found by its key, such as photos/puppy.jpg, in a bucket you create in one Region. A bucket holds any number of objects, and one object can be up to 50 TB.

Durable, and private by default. Every storage class except the two One Zone classes keeps data across at least three Availability Zones, designed for eleven nines of durability. Buckets and objects are private until you grant access, and every new object is encrypted.

Hand over a coat and you get a ticket; the coat is kept safe in the back, in several rooms at once. Show the ticket and you get the coat. You can ask the cloakroom to keep every coat ever handed in under the same ticket, to move coats nobody collects to cheaper storage, or to give a friend a signed pass that works until tonight.

The bucket stays private behind CloudFront. Origin access control lets the distribution read it, while the S3 website endpoint serves only publicly readable content, over HTTP and never HTTPS.

Uploads start work. An event notification can invoke a Lambda function, or go to an SQS queue, an SNS topic or EventBridge, each time an object is created.

Private instances reach S3 without the internet. A gateway endpoint in the VPC's route tables sends their S3 traffic privately, at no charge.

S3 scales to high request rates by itself: at least 3,500 writes or 5,500 reads a second for each partitioned prefix, with no limit on how many prefixes a bucket has. Spread the keys over more prefixes and the rate multiplies; ten prefixes can serve 55,000 reads a second.

Scaling up takes a moment. While S3 grows to a new rate, you may see a few 503 Slow Down errors. They stop once it has scaled.

Big files in parts. Multipart upload sends the parts of one object in parallel and in any order; a single PUT stops at 5 GB.

Far-away uploads. Transfer Acceleration takes uploads in at the nearest CloudFront edge location and carries them to the bucket over an optimised network path.

Block Public Access stays on. It is on by default for new buckets and overrides any policy or ACL that would make data public. AWS recommends turning all four settings on for the whole account.

Policies, not ACLs. New buckets have ACLs disabled, with the bucket owner owning every object, and access is granted with IAM and bucket policies.

Encryption. Every new object is encrypted with SSE-S3 by default. Choose SSE-KMS or DSSE-KMS for keys you control and audit, SSE-C to send your own key with each request, or encrypt on the client before uploading.

Versioning, MFA delete and Object Lock. Versioning keeps every version, so a delete only adds a delete marker. MFA delete asks for an MFA code to delete a version or change versioning, and only the bucket owner's root user can turn it on. Object Lock stops versions being overwritten or deleted for a set time.

Presigned URLs hand out time-limited access with the permissions of whoever signed them, so treat each one like a key.

Storage by the GB-month, set by the storage class, with minimum durations and minimum object sizes in the IA and Glacier classes.

Requests and retrievals: a charge for each request, and for each GB retrieved from the IA and Glacier classes.

Data transfer out. Data coming in from the internet is free.

Every version is a whole object. Three versions of a file are charged as three objects.

Replication adds the destination's storage and requests and the transfer between Regions; Same-Region Replication has no transfer charge.

Lifecycle and Intelligent-Tiering cut the bill as data cools. Intelligent-Tiering adds a small monitoring charge for each object, but no retrieval charges.

Prices change, so none are printed here. Check the S3 pricing page on aws.amazon.com.