S3: Object Storage

S3 (Simple Storage Service) stores files — called objects — inside containers called buckets. There's no folder structure underneath the hood the way a hard drive has one; S3 is a flat key-value store that just looks like folders in the console.

Creating a bucket and uploading a file

bash terminal
aws s3 mb s3://my-app-assets-2026
aws s3 cp ./logo.png s3://my-app-assets-2026/images/logo.png
Output
make_bucket: my-app-assets-2026
upload: ./logo.png to s3://my-app-assets-2026/images/logo.png

images/logo.png looks like a path, but it's really just the object's key — a single string that happens to contain slashes. S3 renders keys with slashes as a folder tree in the console purely for convenience.

Listing and reading objects

bash terminal
aws s3 ls s3://my-app-assets-2026/images/
Output
2026-09-08 14:32:11      48213 logo.png

Public vs. private access

Every bucket is private by default — only your account (and anyone you explicitly grant access to) can read from it. Making an object or bucket public requires deliberately changing that, either through a bucket policy or an access control list:

JSON public-read-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-app-assets-2026/*"
    }
  ]
}
What this does
Lets anyone on the internet read (not write or delete) any object in this bucket — appropriate for public website assets, not for anything containing user data.
The classic S3 mistake: accidentally leaving a bucket containing sensitive data publicly readable is one of the single most common causes of real-world data breaches. AWS now blocks public access by default at the account level ("S3 Block Public Access") specifically because this happened so often — leave that protection on unless you have a specific, reviewed reason to turn it off for one bucket.

Storage classes

Not all data needs to be instantly available. S3 offers cheaper storage classes (like Glacier) for data you rarely access but need to keep, trading retrieval speed for a much lower storage cost — useful for backups and long-term archives.

PreviousIAM: Users, Roles & Policies