CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Amazon S3 — Object Storage
Eleven-nines durable object storage. The default home for files, backups, data lakes, and static sites.
What it is
Infinitely scalable object storage with 99.999999999% durability and a rich set of storage classes.
When I reach for it
- Any blob: images, logs, backups, data-lake files, static website assets.
- As an origin for CloudFront, or a target for lifecycle-tiered archives.
Key architectural decisions
- Storage class by access pattern: Standard (hot), Intelligent-Tiering (unknown/changing), Standard-IA/One Zone-IA (infrequent), Glacier / Deep Archive (archive).
- Lifecycle rules to transition and expire objects automatically.
- Security: Block Public Access on by default, bucket policies, SSE-KMS for audited encryption, enforce TLS with
aws:SecureTransport.
Gotchas & exam traps
- Block Public Access overrides permissive ACLs/policies — a frequent "why is it still private" trap.
- 5 IPs reserved per subnet is EC2/VPC, not S3 — do not confuse storage and networking limits.
- Use a Gateway VPC endpoint to reach S3 privately and dodge NAT data charges.
The architect view
S3 is almost never the wrong answer for durability. Design the lifecycle policy on day one so cost optimization is automatic rather than a later clean-up project.