Amazon S3 Object Storage, Endpoints, and File Storage Differences – SAP-C02 Study Guide

Purpose of This Lesson

Amazon Simple Storage Service (Amazon S3) is AWS object storage for storing and retrieving virtually any type of data, including documents, media, backups, logs, and application files. The most important architectural distinction is that S3 is an object store accessed through APIs—not a mounted file system.

This lesson focuses on S3’s storage model, HTTP-based access, bucket naming, connectivity from VPC resources, and the differences between object and file storage.

Key Concepts

Buckets and objects

An S3 bucket is a logical container for objects. An object is the stored data together with associated information such as:

• An object key
• The object data itself
• Metadata
• A version ID when versioning is enabled
• Access-control information and other object-level attributes

S3 can store many millions or more objects and is designed to scale without requiring the administrator to provision disks or file systems.

S3 objects can contain almost any type of content, including:

• Images, videos, and audio
• PDFs and office documents
• Application exports
• Database backups
• Log files
• Data lake files

Object keys and prefixes

S3 uses a flat namespace. It does not create a true directory hierarchy. Each object is identified by a key, which is effectively the object’s name within the bucket.

For example:

reports/2026/quarter-1/revenue.csv

The segments before revenue.csv are prefixes. The S3 console displays these prefixes like folders, but they are part of one flat object key rather than nested directories.

This distinction matters because S3 operations work on object keys and prefixes. There is no operating-system-style directory mounted by S3.

S3 is a key-value object store

Conceptually, an S3 object consists of:

• Key: The unique object name within a bucket
• Value: The object’s data
• Metadata: Information describing or accompanying the object
• Version ID: An identifier for a particular version when versioning is enabled

S3 also supports controls and subresources associated with buckets and objects, including policies, tags, and access-control mechanisms.

HTTP and REST API access

S3 is accessed through HTTPS endpoints and exposes API operations that map to common HTTP methods:

• GET retrieves an object or resource
• PUT uploads or replaces an object
• POST supports specific upload and service operations
• DELETE removes an object or resource
• HEAD retrieves object metadata without returning the object body
• SELECT is associated with S3 Select operations for querying supported object content

Applications normally use an AWS SDK, such as the AWS SDK for Python (boto3), rather than constructing raw HTTP requests manually.

A request identifies the target bucket and object key through the S3 endpoint and request path or host. The exact URL style can vary by operation and AWS tooling, so architecture decisions should focus on authenticated API access and endpoint selection rather than hard-coding one URL format.

Bucket names are globally unique

S3 bucket names must be unique across the relevant AWS partition, not merely within one AWS account or Region. The bucket name is part of the address used to access the bucket, which is why global uniqueness is required.

A bucket is created in a specific AWS Region, even though S3 is accessed through AWS service endpoints and the data may be designed for global application access.

Access from a VPC

S3 is an AWS service outside a customer’s VPC. Workloads can reach it in multiple ways:

1. Public S3 endpoint through internet connectivity

• A resource in a public subnet can use an internet gateway, provided routing, security controls, and IAM permissions allow access.
• A private-subnet resource commonly uses a NAT gateway for access to public AWS service endpoints.

1. S3 gateway VPC endpoint

• A gateway endpoint provides private connectivity from VPC route tables to S3.
• Traffic does not require an internet gateway or NAT gateway.
• The endpoint is associated with selected route tables.
• Endpoint policies can restrict which S3 actions and resources are reachable through the endpoint.
• Security groups are not attached to gateway endpoints; access is controlled through route tables, endpoint policies, IAM, bucket policies, and related S3 controls.

A gateway endpoint is often preferred for private-subnet workloads that need S3 because it can reduce NAT processing and data-transfer costs while avoiding internet egress paths.

Object storage versus file storage

Characteristic	Amazon S3 object storage	Amazon EFS or traditional file storage
Data model	Objects in buckets	Files in directories
Namespace	Flat; hierarchy is simulated with prefixes	Hierarchical directories and subdirectories
Access method	HTTPS and service APIs	File-system protocols and mount targets
Mountable to an OS	No native file-system mount	Yes, where supported
Connection behavior	Individual API requests	Persistent mounted file-system access
Typical access pattern	Application and data-platform access	Shared file access by applications and users
Common use cases	Backups, media, archives, data lakes, static assets	Shared application files, POSIX file access, content management

A tool that appears to mount S3 as a drive is typically implementing an application layer that translates file operations into S3 API calls. It does not turn S3 into a native hierarchical file system.

Exam-Relevant Takeaways

• S3 is object storage, not block storage or a native file system.
• A bucket is a container; an object is data plus its key and associated metadata.
• S3 has a flat namespace. Apparent folders are created through key prefixes.
• S3 objects are accessed programmatically through HTTPS APIs and AWS SDKs.
• Bucket names are globally unique across the AWS partition.
• A VPC resource can access S3 through public service endpoints or an S3 gateway endpoint.
• An S3 gateway endpoint uses VPC route tables and avoids the need for an internet gateway or NAT gateway for S3 traffic.
• A gateway endpoint policy is an additional authorization control; it does not replace IAM or bucket policies.
• S3 cannot be natively mounted like Amazon EFS. Choose a file service when applications require file-system semantics.
• Private connectivity does not automatically mean the request is authorized. IAM policies, bucket policies, endpoint policies, and S3 Block Public Access settings still matter.

Architecture Decision Guide

Requirement	Recommended approach	Reasoning
Store large volumes of unstructured data	Amazon S3	Highly scalable object storage accessed through APIs
Store data for a backup, archive, or data lake workflow	Amazon S3	Durable object-based storage with lifecycle and storage-class options
Allow EC2 instances in private subnets to access S3 without NAT	S3 gateway VPC endpoint	Uses VPC routing rather than internet or NAT connectivity
Share a mounted file system across Linux workloads	Amazon EFS	Provides file-system semantics and mount targets
Organize S3 data into logical groups	Object key prefixes	Simulates folders without creating real directories
Integrate an application with S3	AWS SDK or S3 API	Uses authenticated HTTPS API operations
Restrict S3 access from a VPC	Combine IAM, bucket policy, and endpoint policy	Provides identity, resource, and network-path controls
Make an object available to an unauthenticated user	Carefully designed public access or presigned URL	Use the narrowest possible exposure; avoid broad bucket public access

Common Exam Traps

• Treating S3 like EFS: S3 objects cannot be natively mounted as a drive. If the requirement says mount, POSIX semantics, or shared file locking, evaluate a file service.
• Assuming folders are real: S3 prefixes are part of object keys. Renaming a folder-like prefix generally means copying objects to new keys and deleting the originals.
• Confusing a gateway endpoint with an interface endpoint: S3 gateway endpoints use route tables and do not require elastic network interfaces in subnets. Interface endpoints use AWS PrivateLink and ENIs.
• Assuming a gateway endpoint bypasses authorization: The endpoint only provides a network path. IAM and S3 resource policies still determine whether the operation succeeds.
• Using NAT by default: A private EC2 instance does not necessarily need a NAT gateway to reach S3. An S3 gateway endpoint is usually simpler and more cost-effective for this path.
• Assuming bucket names are account-local: Bucket names must be globally unique across the AWS partition.
• Confusing object storage with block storage: S3 is not suitable as a boot volume or a low-latency block device. Amazon EBS is the relevant block-storage service for EC2.
• Assuming a public URL means public access: S3 endpoints are addressable over HTTPS, but an object can remain private and require IAM credentials or a presigned URL.

Real-World Engineer Notes

• Use meaningful, stable key conventions such as application/environment/year/month/day/object-name to support lifecycle rules, inventory, discovery, and operations.
• Keep S3 access private by default. Use IAM roles for workloads, S3 Block Public Access, bucket policies, and endpoint policies to enforce least privilege.
• For private-subnet workloads that frequently access S3, compare the cost and operational impact of NAT gateways with gateway endpoints. Gateway endpoints commonly reduce unnecessary NAT traffic.
• Do not select S3 merely because the data is technically a file. The application must be able to use an object API or an integration layer.
• Design applications to handle API semantics, including request failures, retries, multipart uploads for large objects, and eventual workflow concerns around object availability and downstream processing.
• Prefix design should reflect access patterns and operational needs, but avoid assuming that a prefix is an independent file-system directory.
• For cross-Region or global access, separately evaluate replication, latency, data residency, and disaster-recovery requirements; a bucket’s Region remains an important design attribute.

Quick Reference Summary

• Bucket: S3 container; name globally unique.
• Object: Data stored in a bucket.
• Key: Object identifier/name within a bucket.
• Prefix: Key text that appears folder-like in tools.
• Access: HTTPS REST API, AWS CLI, SDKs, and compatible integrations.
• VPC private path: S3 gateway endpoint through VPC route tables.
• File-system alternative: Amazon EFS or another appropriate file service.
• Authorization: IAM plus bucket, endpoint, and other S3 controls.

Flashcards

1. Q: What is the fundamental storage model of Amazon S3?

A: Object storage: data is stored as objects inside buckets and accessed through APIs.

1. Q: What is an S3 bucket?

A: A logical container for S3 objects.

1. Q: What identifies an object within a bucket?

A: Its object key.

1. Q: Are S3 folders real directories?

A: No. Folder-like views are created from prefixes in object keys.

1. Q: What is the value in S3’s key-value model?

A: The object’s actual data.

1. Q: How do applications commonly interact with S3?

A: Through HTTPS APIs using an AWS SDK, CLI, or direct API calls.

1. Q: What is required of an S3 bucket name?

A: It must be globally unique across the AWS partition.

1. Q: What does an S3 gateway VPC endpoint provide?

A: A private VPC route to S3 that does not require an internet gateway or NAT gateway.

1. Q: What controls traffic through an S3 gateway endpoint?

A: VPC route tables determine the path, while the endpoint policy can restrict permitted S3 actions and resources.

1. Q: Can S3 be mounted natively as a file system?

A: No. Applications must use S3 APIs or a translation tool.

1. Q: Which service is more appropriate when an application requires a shared mounted file system?

A: A file service such as Amazon EFS, depending on the required protocol and semantics.

1. Q: Does a private S3 endpoint automatically grant access to objects?

A: No. IAM and S3 resource policies must still authorize the request.

Practice Questions

Question 1

An application runs on EC2 instances in private subnets and frequently reads objects from an S3 bucket. The company wants to remove NAT gateway dependency and keep S3 traffic on the AWS private network path. Which solution is most appropriate?

A. Attach an internet gateway to the private subnets
B. Create an S3 gateway VPC endpoint and associate it with the private subnets’ route tables
C. Create a second NAT gateway in every Availability Zone
D. Mount the S3 bucket as an EBS volume

Correct answer: B

An S3 gateway endpoint adds routes from selected VPC route tables to S3 without requiring NAT or internet gateway connectivity. An S3 bucket is not an EBS volume and cannot be natively mounted as one.

Question 2

A team creates S3 keys such as finance/2026/january/report.csv. An administrator is asked to change the finance folder name to accounting. What should the architect explain?

A. S3 supports atomic directory renames because folders are first-class resources
B. The folder can be renamed by changing a bucket property
C. The apparent folder is a prefix in each key; affected objects must be copied or rewritten to new keys and the old objects removed
D. S3 does not allow prefixes

Correct answer: C

S3 has a flat namespace. finance/ is part of the object key, so changing it requires creating objects with the new keys and handling deletion of the old keys.

Question 3

An application requires several Linux EC2 instances to access the same hierarchical directory tree with normal file operations and file-system semantics. Which storage option best matches this requirement?

A. Amazon S3 accessed through an SDK
B. Amazon EFS mounted by the EC2 instances
C. S3 Glacier Flexible Retrieval
D. Amazon DynamoDB

Correct answer: B

The requirement is for a shared mounted file system. Amazon EFS provides file-system access, whereas S3 requires object API operations and does not provide a native mount.

Question 4

A security engineer configures an S3 gateway endpoint and an endpoint policy allowing access only to one bucket. An EC2 role has no permission to read that bucket. What is the likely result of a read request?

A. The endpoint policy grants the role access automatically
B. The request succeeds because gateway endpoints bypass IAM
C. The request is denied because network-path authorization does not replace IAM authorization
D. The request succeeds only if the bucket is public

Correct answer: C

The endpoint policy can limit access through the endpoint, but IAM and S3 resource policies still participate in authorization. The role must have the required S3 permissions.

Question 5

A company wants to create a bucket named central-backups. The name is already used by another AWS customer. What should the architect recommend?

A. Reuse the name because bucket names are unique only within an account
B. Add an object prefix to make the bucket unique
C. Choose a different globally unique bucket name
D. Create the bucket in another Availability Zone

Correct answer: C

S3 bucket names must be globally unique across the AWS partition. Object prefixes, Availability Zones, and account boundaries do not make an already-used bucket name available.