Working with Amazon S3 Buckets and Objects – SAP-C02 Study Guide

Purpose of This Lesson

Amazon Simple Storage Service (Amazon S3) is an object storage service used to store files and other unstructured data. This lesson focuses on creating buckets, uploading objects, selecting storage and security settings, understanding S3 object keys, and controlling access with bucket policies.

These fundamentals are essential for SAP-C02 scenarios involving data storage, public content, archival, backup, encryption, access control, and resiliency.

Key Concepts

S3 buckets and objects

• A bucket is a container for objects.
• An object consists of the data, metadata, and a unique object key.
• S3 objects can be images, documents, backups, logs, application data, or almost any other file type.
• General purpose S3 buckets store data redundantly across multiple Availability Zones within the selected AWS Region.
• Bucket names belong to a global namespace and must be unique across AWS. The bucket’s data, however, is stored in the AWS Region selected when the bucket is created.

A bucket name is included in S3 request URLs, which is why the name must be globally unique even though the bucket is regional.

General purpose buckets and directory buckets

S3 provides different bucket types for different requirements:

• General purpose buckets are the standard choice for most S3 workloads and support the broadest set of S3 features and storage classes.
• Directory buckets are associated with S3 Express One Zone, which is designed for very low latency and high request rates within a single Availability Zone. They are appropriate only when the workload specifically benefits from this performance profile and can accept single-AZ storage characteristics.

For most exam scenarios involving general object storage, cross-AZ durability, lifecycle management, or broad feature compatibility, choose a general purpose bucket.

Object keys and prefixes

S3 is an object store, not a traditional hierarchical file system. An object has one key, such as:

documents/raspberry.jpg

The slash is simply part of the key string. The S3 console interprets slash-delimited prefixes as folders to make objects easier to organize, but S3 does not create real directories.

This distinction matters when designing applications, writing bucket policies, configuring lifecycle rules, or listing objects by prefix.

Bucket versioning

Versioning preserves multiple versions of an object under the same key. It helps protect against:

• Accidental deletion
• Accidental overwrites
• Application errors
• Recovery requirements

When versioning is enabled, deleting an object normally creates a delete marker instead of immediately removing all versions. Older versions can still incur storage charges, so versioning should generally be paired with lifecycle rules when historical versions do not need to be retained indefinitely.

Versioning is also a prerequisite for capabilities such as S3 Object Lock in many retention designs.

Encryption

S3 supports server-side encryption, including:

• SSE-S3: Keys are managed by Amazon S3. This is the simplest default for many workloads.
• SSE-KMS: Keys are managed through AWS Key Management Service. This provides more control over key policies, grants, auditing, and key rotation, but introduces KMS permissions and request considerations.
• DSSE-KMS: Dual-layer server-side encryption using two layers of KMS-based encryption for workloads requiring that additional protection.

S3 encrypts new objects by default with server-side encryption. Select SSE-KMS when the requirements include customer-controlled key policies, centralized key governance, or detailed KMS auditability.

Encryption at rest does not automatically make an object publicly accessible or private. Access is controlled separately through IAM, bucket policies, resource policies, access points, and—where applicable—ACLs.

S3 storage classes

The storage class should reflect access frequency, retrieval requirements, availability needs, and retention duration.

Storage class	Typical use	Important consideration
S3 Standard	Frequently accessed data	Highest availability and millisecond access, with higher storage cost than colder tiers
S3 Intelligent-Tiering	Unknown or changing access patterns	S3 monitors access and moves objects between access tiers; monitoring and automation charges apply
S3 Standard-IA	Infrequently accessed data needing rapid retrieval	Retrieval charges and minimum storage-duration considerations apply
S3 One Zone-IA	Infrequently accessed, recreatable data	Stored in one Availability Zone; lower resilience than multi-AZ classes
S3 Glacier Instant Retrieval	Archive data requiring immediate access	Retrieval and minimum-duration costs apply
S3 Glacier Flexible Retrieval	Archive data with minutes-to-hours retrieval tolerance	Retrieval time depends on the selected retrieval tier
S3 Glacier Deep Archive	Long-term archive with rare access	Lowest storage cost but longest retrieval times and minimum-duration considerations
S3 Express One Zone	Very low-latency, high-performance workloads	Single-AZ storage model and specialized directory bucket requirements

S3 Standard-IA and Glacier classes are not automatically cheaper for every workload. Request, retrieval, and minimum-storage-duration charges must be included in the design.

Block Public Access

S3 Block Public Access provides guardrails that prevent public access through bucket policies, access point policies, or ACLs. It is normally the secure default.

If a legitimate use case requires public objects—such as a public website or publicly downloadable content—public access settings must be deliberately changed and the policy must allow the intended access. This should be treated as an exception, not a default configuration.

For many public-content architectures, a safer design is:

1. Keep the S3 bucket private.
2. Place Amazon CloudFront in front of the bucket.
3. Use Origin Access Control (OAC) so CloudFront can retrieve objects.
4. Allow direct S3 access only to the CloudFront distribution.

ACLs and bucket policies

S3 access control can involve several mechanisms:

• IAM identity policies grant permissions to IAM users, groups, and roles.
• Bucket policies are resource-based JSON policies attached to a bucket.
• Access point policies provide separate access controls and network settings for access points.
• ACLs are an older access-control mechanism and are disabled by default for new buckets under the S3 Object Ownership model.

For most modern designs, use IAM policies and resource-based policies rather than enabling ACLs. ACLs may still be relevant for legacy applications or specific cross-account requirements.

Bucket policy resource ARNs

A bucket ARN and an object ARN represent different resources:

arn:aws:s3:::example-bucket
arn:aws:s3:::example-bucket/*

Use the bucket ARN for bucket-level actions such as listing a bucket. Use the object ARN pattern with /* for object-level actions such as s3:GetObject.

Example public-read statement for objects:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadObjects",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

This policy grants read access to objects, not permission to list the bucket. The Principal value of "*" makes the objects publicly readable, so it should be used only when explicitly required.

Object Lock

S3 Object Lock supports a write-once-read-many (WORM) model. It can prevent objects from being overwritten or deleted for a defined retention period or until a legal hold is removed.

Object Lock is useful for compliance records, regulated data, and immutable backups. It is not the same as versioning:

• Versioning retains prior versions.
• Object Lock applies retention or legal-hold controls that prevent deletion or modification.

Retention settings must be designed carefully because they can prevent legitimate cleanup operations.

S3 access points

S3 Access Points provide distinct endpoints and policies for different applications or teams accessing the same bucket. They can simplify access management at scale by separating permissions without creating many buckets.

Access points are useful when multiple applications need different permissions, prefixes, or network restrictions. They do not replace the underlying bucket policy and IAM controls; the complete authorization path must allow the request.

Exam-Relevant Takeaways

• S3 bucket names are globally unique, but bucket data is associated with a selected AWS Region.
• General purpose buckets are the default choice for most S3 requirements.
• S3 Express One Zone uses directory buckets and a single-AZ storage model for very low latency.
• S3 does not have real folders. Folder-like paths are prefixes within object keys.
• Use versioning to recover from overwrites and accidental deletes; manage old versions with lifecycle rules.
• New S3 buckets normally use S3 Object Ownership with ACLs disabled. Prefer IAM and bucket policies.
• Keep Block Public Access enabled unless public access is an explicit requirement.
• s3:GetObject requires an object resource such as arn:aws:s3:::bucket-name/*, not just the bucket ARN.
• SSE-S3 is the simplest server-side encryption option. SSE-KMS is appropriate when customer-controlled keys and KMS auditing are required.
• One Zone-IA is appropriate only when data can tolerate loss of access if that Availability Zone fails, or when the data can be recreated.
• Storage class selection must include retrieval fees, request charges, minimum storage durations, and access latency.
• Object Lock is for immutability and retention, not merely for keeping multiple versions.
• Encryption and authorization solve different problems: encrypted data can still be public if a policy permits access.

Architecture Decision Guide

Requirement	Recommended approach	Key tradeoff or validation
Normal object storage with high durability and frequent access	General purpose bucket with S3 Standard	Higher storage cost than colder classes
Unknown or changing access frequency	S3 Intelligent-Tiering	Monitoring and tier-transition charges apply
Rare access but immediate retrieval required	Standard-IA or Glacier Instant Retrieval	Retrieval and minimum-duration charges
Data is recreatable and single-AZ storage is acceptable	One Zone-IA	Reduced resilience and AZ-level availability
Long-term archive with infrequent retrieval	Glacier Flexible Retrieval or Deep Archive	Retrieval delays and minimum-duration requirements
Very low latency within one AZ	S3 Express One Zone directory bucket	Single-AZ design and specialized bucket model
Recover from accidental overwrite or deletion	Enable versioning	Previous versions consume storage and need lifecycle management
Enforce immutable retention	Object Lock with versioning	Retention can block deletion and overwrite operations
Centralized customer-controlled encryption	SSE-KMS	Requires KMS permissions and may add KMS request costs
Public static content	Prefer private S3 plus CloudFront OAC	Requires CloudFront configuration and policy integration
Multiple applications need different access paths	S3 Access Points	Authorization must still satisfy IAM and bucket-level controls
Legacy application depends on object ACLs	Consider enabling or preserving ACL support only when required	More complex access management and weaker modern default posture

Common Exam Traps

• Confusing a bucket ARN with an object ARN: s3:GetObject applies to objects, so the resource generally needs bucket-name/*.
• Assuming S3 folders are real directories: A “folder” is usually a key prefix. Deleting a folder means deleting objects whose keys use that prefix.
• Assuming all S3 storage classes are multi-AZ: One Zone-IA and S3 Express One Zone use a single Availability Zone.
• Making a bucket public unnecessarily: Public access is often avoidable with CloudFront OAC, presigned URLs, or authenticated application access.
• Treating versioning as backup: Versioning helps recover from object-level mistakes but does not replace a complete backup and recovery strategy.
• Forgetting old versions: Lifecycle policies should address noncurrent versions, delete markers, and incomplete multipart uploads where appropriate.
• Assuming encryption grants access: Encryption protects stored data; IAM and resource policies determine who can retrieve it.
• Ignoring retrieval charges: Glacier and infrequent-access classes may be more expensive than Standard for workloads with frequent reads.
• Using Object Lock casually: Retention and legal holds can prevent deletion even for administrators until the controls expire or are properly removed.
• Assuming a bucket policy alone determines access: IAM policies, explicit denies, Block Public Access, permissions boundaries, SCPs, KMS key policies, and network restrictions can also affect authorization.

Real-World Engineer Notes

• Use naming conventions that identify the environment, application, data classification, and owner, while still ensuring global uniqueness.
• Enable default encryption and choose SSE-KMS when key ownership, separation of duties, or audit requirements justify the added operational complexity.
• Apply least privilege at both the bucket and object-prefix levels. Avoid broad Principal: "*" permissions.
• For browser or client uploads, consider presigned URLs so clients can upload without receiving AWS credentials.
• Use CloudFront with Origin Access Control instead of making an origin bucket publicly readable whenever the content does not need direct public S3 access.
• Add lifecycle rules for transitions, expiration, noncurrent versions, and incomplete multipart uploads.
• Use S3 Inventory, CloudTrail data events, access logs, and monitoring controls when object-level auditing is required.
• Consider replication, backup, or multi-Region architecture separately from ordinary S3 durability. A highly durable regional bucket does not automatically provide protection from every regional or account-level failure scenario.
• When using SSE-KMS, verify both the IAM permissions and the KMS key policy. A user may have S3 permissions but still be unable to decrypt the object.

Quick Reference Summary

• Bucket: Regional container with a globally unique name.
• Object: Data plus metadata identified by a key.
• Key: Complete string, including any apparent folder prefix.
• Default access posture: Keep Block Public Access enabled and ACLs disabled.
• Object access policy resource: arn:aws:s3:::bucket-name/*.
• Versioning: Retains object versions and supports recovery from overwrites and deletes.
• Object Lock: Enforces WORM retention or legal holds.
• SSE-S3: Simple S3-managed encryption.
• SSE-KMS: Customer-controlled KMS key management and audit integration.
• Standard: Frequent access and high availability.
• Intelligent-Tiering: Unknown or changing access patterns.
• One Zone-IA: Infrequent access where single-AZ storage is acceptable.
• Glacier classes: Archive-oriented storage with retrieval considerations.
• S3 Express One Zone: Low latency in a single AZ using directory buckets.

Flashcards

1. What is the difference between an S3 bucket and an S3 object?

A bucket is the container; an object is the stored data, metadata, and key within that bucket.

2. Why must an S3 bucket name be globally unique?

The name is part of globally addressable S3 URLs and therefore belongs to a global namespace.

3. Are S3 folders real directories?

No. They are console representations of prefixes in object keys.

4. What ARN should normally be used for s3:GetObject on every object in a bucket?

arn:aws:s3:::bucket-name/*.

5. What does S3 versioning protect against?

Accidental overwrites and deletions by retaining multiple object versions.

6. Does versioning make S3 data immutable?

No. Object Lock is the S3 feature used for WORM retention and legal holds.

7. When should SSE-KMS be selected instead of SSE-S3?

When the design needs customer-controlled keys, key policies, centralized governance, or detailed KMS auditing.

8. What is the main risk of S3 One Zone-IA?

The data is stored in one Availability Zone, so it has lower resilience to an AZ failure than multi-AZ storage classes.

9. What is the secure default for S3 public access?

Keep S3 Block Public Access enabled and use private access patterns unless public access is explicitly required.

10. What is S3 Intelligent-Tiering designed for?

Objects whose access patterns are unknown or change over time, allowing S3 to move them between access tiers.

11. What does an S3 Access Point provide?

A dedicated endpoint and policy that can simplify distinct access requirements for multiple applications or teams.

12. What does S3 Object Lock enforce?

Retention or legal holds that prevent an object version from being deleted or overwritten during the protected period.

Practice Questions

Question 1

A company stores user-uploaded images in S3. The images are frequently accessed, must remain available if an Availability Zone fails, and do not have an archive requirement. Which option is the best initial storage choice?

A. S3 One Zone-IA
B. S3 Standard
C. S3 Glacier Deep Archive
D. S3 Express One Zone

Correct answer: B. S3 Standard

S3 Standard is designed for frequently accessed data and provides multi-AZ regional resilience. One Zone-IA has a single-AZ model, Glacier Deep Archive is intended for long-term archival, and Express One Zone is a specialized low-latency single-AZ option.

Question 2

An administrator adds this statement to a bucket policy:

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::reports-bucket"
}

The administrator expects users to download objects but the policy does not grant the intended access. What is the most likely problem?

A. s3:GetObject requires the bucket ARN with a trailing slash
B. s3:GetObject requires an object resource such as arn:aws:s3:::reports-bucket/*
C. s3:GetObject can only be granted with an ACL
D. S3 does not support resource-based policies

Correct answer: B.

The bucket ARN identifies the bucket itself. Object actions require object ARNs, commonly expressed with /* to match all objects. Also, Block Public Access could independently prevent a public policy from taking effect.

Question 3

A regulated organization must prevent application operators from deleting or overwriting financial records for seven years. Which S3 capability best meets this requirement?

A. S3 Standard-IA
B. S3 Intelligent-Tiering
C. S3 Object Lock with a retention period
D. S3 Transfer Acceleration

Correct answer: C. S3 Object Lock with a retention period

Object Lock provides WORM-style retention and can prevent deletion or overwrite during the configured period. Storage class selection and transfer acceleration do not provide immutability.

Question 4

A company wants a public website hosted with S3, but its security policy prohibits direct public access to S3 buckets. Which architecture best satisfies both requirements?

A. Disable Block Public Access and grant Principal: "*" s3:GetObject
B. Use a private bucket, CloudFront, and Origin Access Control
C. Enable ACLs and grant public-read on every object
D. Store the objects in One Zone-IA and expose the bucket URL

Correct answer: B.

CloudFront can serve public content while the S3 bucket remains private. Origin Access Control allows the distribution to retrieve objects, and the bucket policy can restrict reads to that CloudFront distribution.

Question 5

An analytics workload reads objects unpredictably. Some objects are accessed heavily for several weeks, while others are rarely read. The company wants S3 to optimize storage costs without manually changing storage classes. Which option is most appropriate?

A. S3 Standard for every object
B. S3 Intelligent-Tiering
C. S3 Glacier Deep Archive
D. S3 One Zone-IA for every object

Correct answer: B. S3 Intelligent-Tiering

Intelligent-Tiering is intended for unknown or changing access patterns and automatically moves objects between access tiers. The design should still account for monitoring and automation charges and confirm that retrieval latency meets application requirements.