Amazon S3 Exam Cram: Storage, Security, Performance, and Lifecycle – SAP-C02 Study Guide

Purpose of This Lesson

Amazon S3 is a foundational AWS service in SAP-C02 architecture scenarios. Exam questions commonly test bucket and object behavior, access control, encryption, versioning, lifecycle management, transfer optimization, and cross-account access.

This guide consolidates the S3 facts and design decisions most likely to affect an architecture answer.

Key Concepts

Buckets and Objects

• S3 stores objects inside buckets. An object can be any file type.
• A single object can range from 0 bytes to 5 TB.
• A bucket has a globally unique name but is created in one AWS Region.
• Objects remain in their original Region unless replication or another copy operation moves them.
• S3 provides virtually unlimited object storage, subject to service quotas and account limits.
• A bucket is a flat namespace. S3 does not have nested folders or nested buckets.
• Prefixes and object keys can create a folder-like appearance, such as logs/2026/09/application.log.
• The object key uniquely identifies an object within a bucket.
• The storage class and permissions are properties associated with individual objects.
• A default quota is 100 buckets per AWS account, although this quota can be increased.
• S3 provides strong read-after-write consistency for object reads, overwrites, and deletes.

Create buckets in a Region appropriate for the workload and its data-residency requirements. For geographically distributed users, placing S3 near users can reduce origin latency, but CloudFront, Transfer Acceleration, or replication may be more appropriate than choosing a bucket Region solely for proximity.

Storage Classes and Lifecycle Management

S3 storage classes represent different tradeoffs among storage price, retrieval cost, availability, minimum storage duration, and access frequency. Select the class based on the access pattern rather than simply choosing the lowest storage price.

Lifecycle management has two primary action types:

• Transition actions: Move objects to a different storage class after a defined period.
• Expiration actions: Delete objects, or delete expired object versions and delete markers when versioning is enabled.

Lifecycle rules can be scoped to a whole bucket or to objects matching a prefix or tag. Transition paths have restrictions; an object cannot be moved arbitrarily between every storage class. In particular, lifecycle rules do not transition objects back into S3 Standard, and several lower-cost classes have limited valid transition paths.

Consider minimum storage-duration charges and retrieval fees before moving frequently accessed or short-lived objects into archival or infrequent-access classes.

Versioning

Versioning preserves multiple versions of an object under the same key. It is useful for:

• Recovering from accidental deletion.
• Recovering from accidental overwrites.
• Maintaining historical object versions.
• Supporting replication and protection workflows.

A delete operation on a versioned bucket usually creates a delete marker rather than permanently removing every version. A specific version must be permanently deleted by referencing its version ID.

Versioning is enabled at the bucket level. Once enabled, it can be suspended, but suspending it does not remove existing versions.

MFA Delete

MFA Delete adds an MFA requirement for sensitive versioning operations, including permanently deleting an object version and changing the versioning state of a bucket.

Important constraints include:

• Versioning must be enabled.
• The request must include the x-amz-mfa header when MFA is required.
• MFA Delete is configured using the AWS account root user, not a normal IAM user.
• MFA Delete should not be confused with a bucket policy that requires recent MFA authentication for access.

The aws:MultiFactorAuthAge condition key can be used in an IAM or bucket policy to require MFA-based access for protected API operations. That policy-based control is broader than MFA Delete and can apply to access requests beyond version-management operations.

S3 Access Control

S3 supports identity-based IAM policies, resource-based bucket policies, and legacy ACLs.

#### IAM Policies

IAM policies are identity-based. They are attached to IAM users, groups, or roles, so they do not define a principal inside the policy document.

IAM policies are useful when:

• The identity needs permissions across multiple AWS services.
• A centralized IAM access model is preferred.
• Many S3 buckets share permissions associated with the same identities.

#### Bucket Policies

Bucket policies are resource-based JSON policies attached to S3 buckets. They explicitly identify principals and are particularly useful for:

• Cross-account access.
• Granting access directly to an AWS account, role, user, or service.
• Enforcing bucket-wide conditions such as encryption requirements, TLS, source VPC endpoints, or MFA.

A bucket policy can grant access only to the resources and actions covered by the policy. It does not replace the need to evaluate identity policies, permissions boundaries, SCPs, KMS key policies, and other applicable controls.

#### ACLs

S3 ACLs are a legacy access-control mechanism that can apply to buckets or individual objects. They offer fewer principals and permissions than policy-based authorization. Prefer IAM policies and bucket policies unless a specific legacy integration requires ACLs. New buckets commonly use Bucket owner enforced Object Ownership, which disables ACLs.

Cross-Account Access

For programmatic cross-account access, common choices include:

• A bucket policy granting access to a principal in another account.
• An IAM role in the resource-owning account that the other account assumes.
• A combination of a bucket policy and an identity policy, where both sides allow the request.

Use a cross-account IAM role when users need console access, temporary credentials, or access to multiple AWS services. A bucket policy can be simpler when the requirement is limited to direct programmatic access to a bucket.

S3 Encryption

S3 supports server-side and client-side encryption:

• SSE-S3: S3 manages the encryption keys and performs AES-256 encryption.
• SSE-KMS: AWS KMS manages the key. This provides centralized key policies, auditability through AWS CloudTrail, and additional controls, but introduces KMS permissions, quotas, and request costs.
• SSE-C: The customer supplies an encryption key with each request. S3 performs the server-side encryption but does not permanently store the customer-provided key.
• Client-side encryption: The application encrypts data before uploading it and manages the encryption keys and decryption process.

S3 default encryption applies server-side encryption automatically to new objects. Enabling it does not retroactively change objects already stored in the bucket. Existing objects require a rewrite or copy operation to change their encryption state.

When using SSE-KMS, verify both S3 permissions and KMS permissions. Cross-account and restrictive key-policy scenarios can fail even when the bucket policy appears correct.

Event Notifications

S3 event notifications can be sent to:

• Amazon SNS topics.
• Amazon SQS queues.
• AWS Lambda functions.

Notifications are useful for triggering processing after object creation or other supported bucket events. Design consumers to tolerate duplicate or out-of-order notifications, and use filtering by prefix or suffix where appropriate.

Multipart Upload

Multipart upload divides a large object into independently uploaded parts. Parts can be uploaded in parallel and in any order, improving throughput and allowing failed parts to be retried without restarting the entire upload.

• Multipart upload can be used for objects from 5 MB through the 5 TB maximum object size.
• It is required for objects larger than 5 GB.
• It is commonly recommended for objects larger than approximately 100 MB, especially over unreliable or high-latency networks.
• Incomplete multipart uploads consume storage until completed or aborted, so lifecycle rules should clean up abandoned uploads.

Transfer Acceleration

S3 Transfer Acceleration uses CloudFront edge locations as entry points for uploads and downloads over long distances. It is useful when clients are geographically distant from the bucket Region and direct internet transfer performance is poor.

Transfer Acceleration:

• Must be enabled on the bucket.
• Uses the accelerated S3 endpoint.
• Does not change the bucket’s Region.
• Is secured using the normal S3 authentication and authorization model.
• Can be suspended after being enabled, but not permanently disabled.

For ordinary global content delivery, CloudFront with S3 as an origin is often the more appropriate architecture. Transfer Acceleration primarily addresses transfer performance to or from S3 rather than cached content delivery.

Copying Objects

The S3 CopyObject operation can copy objects up to 5 GB in a single operation. It can be used to:

• Create another object copy.
• Rename an object by copying it to a new key and deleting the old key.
• Change the storage class.
• Change server-side encryption settings.
• Change metadata.
• Copy data between buckets or Regions.

Objects larger than 5 GB require multipart copy. Copying across Regions can incur data-transfer charges and does not automatically establish continuous replication.

Logging and CORS

S3 server access logging records requests made to a bucket, including information such as the requester, bucket, request time, operation, response status, and error code.

Server access logging is disabled by default. To enable it:

• Configure a separate destination bucket.
• Optionally configure a log-object prefix.
• Grant the S3 Log Delivery group permission to write to the destination bucket.
• Account for the storage consumed by log objects.

S3 CORS rules control browser-based cross-origin requests. A rule can specify allowed origins, methods, and headers using a JSON configuration. CORS is a browser behavior control; it is not an authorization mechanism and does not grant access to private objects by itself.

Performance and Request Scaling

The commonly tested S3 request-rate guidance is at least:

• 3,500 PUT, COPY, POST, or DELETE requests per second per prefix.
• 5,500 GET or HEAD requests per second per prefix.

S3 automatically scales, but a workload can improve throughput by:

• Parallelizing requests.
• Using multipart upload.
• Using byte-range fetches for large objects.
• Retrying transient failures with exponential backoff.
• Keeping compute and S3 in the same Region where practical.
• Using Transfer Acceleration when long-distance uploads are the bottleneck.

Do not treat prefixes as folders requiring manual partitioning. Prefixes are logical key namespaces used for organization, filtering, and request distribution.

Exam-Relevant Takeaways

• Bucket names are globally unique; buckets are regional.
• S3 is a flat object store. Prefixes simulate folders but do not create hierarchy.
• The maximum object size is 5 TB.
• Versioning protects against accidental overwrites and deletions, but it does not prevent deletion unless paired with appropriate permissions or retention controls.
• Suspending versioning does not delete prior versions.
• MFA Delete requires versioning and is configured by the root account.
• Default encryption affects new objects only.
• SSE-KMS requires authorization in both S3 and KMS.
• Bucket policies are resource-based; IAM policies are identity-based.
• ACLs are legacy and should generally be avoided for new designs.
• Multipart upload is mandatory above 5 GB and useful for large or unreliable transfers.
• Single-request S3 copy is limited to 5 GB; use multipart copy for larger objects.
• CORS controls browser-origin behavior, not object authorization.
• Lifecycle transitions and expirations must account for access patterns, retrieval fees, and minimum storage durations.
• Cross-account console access is usually best handled with an assumable IAM role.

Architecture Decision Guide

Requirement	Preferred S3 capability	Important considerations
Protect against accidental overwrite or delete	Versioning	Adds storage for retained versions; deletion requires version-aware controls
Require MFA for permanent version deletion	MFA Delete	Requires versioning and root-account configuration
Centralized encryption-key governance	SSE-KMS	Check KMS key policy, IAM permissions, quotas, and cost
Encrypt before data reaches AWS	Client-side encryption	Application owns key management and decryption
Simple cross-account bucket access	Bucket policy	Use least privilege and explicitly identify the external principal
Cross-account console and multi-service access	IAM role assumption	Provides temporary credentials and a consistent access path
Browser access from another origin	CORS configuration	Does not make a private object public or grant authorization
Large uploads over unreliable links	Multipart upload	Abort incomplete uploads and retry individual parts
Long-distance upload acceleration	S3 Transfer Acceleration	Enable on the bucket; evaluate the additional transfer cost
Automatic archival or cleanup	Lifecycle rules	Validate transition paths, minimum durations, and retrieval costs
Request auditing at the bucket level	S3 server access logging	Requires a separate destination bucket and log-delivery permissions

Common Exam Traps

• Confusing a bucket name with a regional namespace: Names are globally unique, but the bucket itself is regional.
• Assuming S3 has real directories: Prefixes are key-name conventions, not nested containers.
• Assuming default encryption encrypts existing data: It applies to new objects only.
• Treating versioning as a complete security control: A user with sufficient permissions can still permanently delete versions.
• Using ACLs as the default modern solution: Prefer bucket policies, IAM policies, and S3 Object Ownership settings.
• Forgetting KMS authorization: SSE-KMS requests can fail because the caller lacks kms:Encrypt, kms:Decrypt, or related permissions.
• Using a single CopyObject request for a 10 GB object: Objects above 5 GB require multipart copy.
• Assuming CORS grants access: CORS only controls whether browsers allow cross-origin requests.
• Choosing Transfer Acceleration for cached global content: CloudFront is generally the caching and distribution service; Transfer Acceleration improves transfer paths to S3.
• Ignoring incomplete multipart uploads: Abandoned parts remain billable until completed or removed.
• Assuming lifecycle transitions are unrestricted: Storage classes have valid transition paths and minimum-duration constraints.
• Forgetting delete markers: Deleting the current version in a versioned bucket may hide the object without deleting earlier versions.

Real-World Engineer Notes

• Use separate buckets or prefixes for different retention, ownership, and lifecycle requirements, but avoid creating buckets solely to imitate directories.
• Apply explicit bucket policies that require TLS and, where appropriate, restrict access to approved VPC endpoints or organizational accounts.
• For sensitive data, combine versioning, least-privilege access, encryption, logging, and retention controls rather than relying on one feature.
• Add lifecycle rules to expire incomplete multipart uploads and remove obsolete versions when business retention permits.
• Use S3 Inventory, CloudTrail data events, or server access logging according to the required audit detail and cost profile.
• Replication is a separate design decision. A copied object or cross-Region copy is not the same as continuously configured S3 Replication.
• For high-throughput applications, design clients for concurrency, retries, idempotency, and partial-object access rather than relying on one large sequential request.

Quick Reference Summary

• Container: Bucket
• Stored item: Object
• Object identifier: Key
• Maximum object size: 5 TB
• Namespace: Flat; prefixes simulate folders
• Bucket naming: Globally unique
• Bucket placement: One AWS Region
• Consistency: Strong read-after-write consistency
• Versioning: Retains multiple object versions
• MFA Delete: Root-account configuration; versioning required
• Encryption choices: SSE-S3, SSE-KMS, SSE-C, client-side
• Default encryption: New objects only
• Multipart upload: Required above 5 GB; useful for large files
• Single-request copy limit: 5 GB
• Notifications: SNS, SQS, Lambda
• Transfer Acceleration: CloudFront edge network for long-distance S3 transfers
• Access controls: IAM policies, bucket policies, legacy ACLs
• Browser cross-origin control: CORS

Flashcards

1. Q: What is the maximum size of an S3 object?

A: 5 TB.

1. Q: Are S3 buckets global or regional?

A: Bucket names are globally unique, but each bucket is created in a specific AWS Region.

1. Q: Does S3 support nested folders?

A: No. S3 has a flat namespace; prefixes and key names provide a folder-like view.

1. Q: What does S3 versioning protect against?

A: Accidental overwrites and deletions by retaining prior object versions.

1. Q: Does suspending versioning delete existing versions?

A: No. Existing versions remain until explicitly removed.

1. Q: Who configures MFA Delete?

A: The AWS account root user; the bucket must have versioning enabled.

1. Q: What is the difference between an IAM policy and a bucket policy?

A: An IAM policy is identity-based and attached to an identity; a bucket policy is resource-based and attached to an S3 bucket.

1. Q: What is the main limitation of S3 ACLs compared with policies?

A: ACLs provide a more limited authorization model and are a legacy mechanism.

1. Q: Does S3 default encryption encrypt existing objects?

A: No. It applies automatically to newly uploaded objects.

1. Q: When is multipart upload mandatory?

A: For objects larger than 5 GB.

1. Q: What services can receive S3 event notifications?

A: SNS, SQS, and Lambda.

1. Q: What is S3 Transfer Acceleration designed to improve?

A: Long-distance transfers to and from S3 by using CloudFront edge locations.

1. Q: What is the single-request S3 copy limit?

A: 5 GB; larger objects require multipart copy.

1. Q: Does CORS grant permission to read a private S3 object?

A: No. CORS controls browser behavior; IAM and S3 authorization still apply.

Practice Questions

Question 1

A company stores customer documents in an S3 bucket. An administrator accidentally overwrites documents several times each week. The company must be able to restore the prior contents without changing the application’s object keys. Which solution best meets the requirement?

A. Enable S3 Transfer Acceleration
B. Enable S3 Versioning
C. Enable S3 server access logging
D. Configure an S3 CORS rule

Correct answer: B. Enable S3 Versioning

Versioning keeps multiple variants of an object under the same key, allowing earlier versions to be retrieved. Logging records requests but does not preserve prior object data.

Question 2

An application in Account A must upload encrypted objects to a bucket in Account B. Account B requires centralized key management and auditing for the encryption key. Which combination should the architect configure?

A. SSE-C and an S3 ACL
B. SSE-KMS, an IAM permission for the caller, and an appropriate KMS key policy
C. Client-side encryption with the AWS account root key
D. SSE-S3 and a CORS configuration

Correct answer: B. SSE-KMS, an IAM permission for the caller, and an appropriate KMS key policy

SSE-KMS provides KMS-managed key governance and auditability. The caller must be authorized by the relevant identity policy and KMS key policy, with the bucket policy also allowing the required S3 operation where applicable.

Question 3

A media company uploads 12 GB video files from offices in Europe to an S3 bucket in the United States. Uploads frequently fail near completion because of intermittent network problems. Which design most directly improves reliability and transfer efficiency?

A. Upload each file with one PutObject request
B. Use multipart upload with parallel part transfers and retries
C. Enable CORS on the bucket
D. Copy the object after the upload fails

Correct answer: B. Use multipart upload with parallel part transfers and retries

Multipart upload allows parts to be transferred independently and failed parts to be retried without restarting the entire 12 GB upload. Transfer Acceleration could also help long-distance performance, but multipart upload directly addresses failures near completion.

Question 4

A web application hosted at app.example.com makes browser requests to objects in an S3 bucket. The bucket and objects are private. The browser blocks the requests because the S3 response lacks the required cross-origin headers. What should the architect configure?

A. An S3 CORS rule and normal S3 authorization for the objects
B. An S3 ACL granting public-read access
C. MFA Delete
D. S3 server access logging

Correct answer: A. An S3 CORS rule and normal S3 authorization for the objects

CORS adds the required browser response headers, but it does not authorize access. The application still needs a secure access mechanism, such as signed requests or an authorized backend.

Question 5

A company wants employees in another AWS account to access an S3 bucket through the AWS Management Console and also assume permissions for other AWS services. Which approach is most appropriate?

A. Grant the external account access only with an object ACL
B. Configure an assumable cross-account IAM role
C. Enable S3 Transfer Acceleration
D. Add a lifecycle transition rule

Correct answer: B. Configure an assumable cross-account IAM role

An IAM role provides temporary credentials and can include permissions for S3 and other AWS services. It is the standard approach for cross-account console access and broader delegated administration.