Amazon S3: buckets, objects and storage classes

Why object storage?

Disks fill up, break, and need someone to look after them. Amazon S3 (Simple Storage Service) is storage you never size: you put files in and pay for what you store and the requests you make. It is designed for 99.999999999 percent durability (eleven nines), by keeping copies across several Availability Zones in the region. That is why so many apps keep photos, invoices, backups and logs there.

Buckets, objects and keys

A bucket is a container for objects. Its name must be unique across all AWS accounts, 3 to 63 characters, lowercase letters, numbers, dots and hyphens. You choose the region when you create it, and the data stays in that region unless you copy it out. An object is a file plus metadata. Its key is its full name inside the bucket, such as invoices/2026/03/inv-001.pdf. A single object can be up to 5 TB. One PUT request can upload up to 5 GB; for larger files (and in practice for anything over about 100 MB) use multipart upload, which the AWS CLI does for you automatically.

S3 has no real folders. The console shows invoices/ as a folder only because many keys start with that prefix. A prefix is just the beginning of a key. This matters: "renaming a folder" really means copying every object to a new key and deleting the old one.

Working with the CLI

aws s3 mb s3://asha-invoices-2026 --region ap-south-1
aws s3 cp inv-001.pdf s3://asha-invoices-2026/invoices/2026/03/inv-001.pdf
aws s3 ls s3://asha-invoices-2026/invoices/2026/
aws s3 cp s3://asha-invoices-2026/invoices/2026/03/inv-001.pdf ./download.pdf
aws s3 sync ./site s3://asha-site-bucket --delete        # make the bucket match the folder
aws s3 cp backup.tar.gz s3://asha-backups/db/ --storage-class STANDARD_IA

Storage classes

Every object has a storage class. Cheaper classes charge less per GB but add retrieval fees, a minimum storage time or a slower first byte. Choose by how often you read the data and how fast you need it.

S3 Express One Zone is a special high-performance class in a single AZ, using "directory buckets", for workloads that need single-digit millisecond access, such as machine learning training. Most apps do not need it.

Versioning

With versioning turned on, overwriting an object keeps the old version, and deleting adds a "delete marker" instead of removing the data. You can bring back an older version after a mistake or a ransomware attack. Once enabled, versioning can be suspended but not switched off. Old versions are billed too, so pair versioning with a lifecycle rule that expires them.

Lifecycle rules

A lifecycle rule moves objects to cheaper classes or deletes them as they age, with no code. This rule moves logs/ to Standard-IA after 30 days and to Glacier Flexible Retrieval after 90, deletes them after a year, and removes old versions 30 days after they are replaced.

{
  "Rules": [
    {
      "ID": "age-out-logs",
      "Filter": { "Prefix": "logs/" },
      "Status": "Enabled",
      "Transitions": [
        { "Days": 30, "StorageClass": "STANDARD_IA" },
        { "Days": 90, "StorageClass": "GLACIER" }
      ],
      "Expiration": { "Days": 365 },
      "NoncurrentVersionExpiration": { "NoncurrentDays": 30 }
    }
  ]
}

Replication

Replication copies new objects to another bucket automatically: Cross-Region Replication (CRR) for disaster recovery or lower latency in another region, and Same-Region Replication (SRR) for copies in another account. Versioning must be on in both buckets. Objects that existed before the rule are not copied unless you run S3 Batch Replication.