AWS S3 (Simple Storage Service) – Complete Step-by-Step Tutorial

Back to: AWS-Basics-Advanced

1. What is Amazon S3?

Amazon S3 (Simple Storage Service) is an object storage service provided by AWS to store and retrieve any amount of data, from anywhere, at any time.

Key Characteristics

• Object-based storage (not block or file system)
• Highly durable (99.999999999% – 11 9’s)
• Scalable and cost-effective
• Used for backups, logs, images, videos, ML datasets, static websites

2. Basic Terminology in S3

Bucket

• A bucket is a top-level container in S3
• All objects are stored inside a bucket
• Bucket name must be globally unique

Example:

Object

• An object is the actual file stored in S3
• Object = File + Metadata + Object Key

Object Key

• The full path of the object inside the bucket

Example:

3. Creating an S3 Bucket (Step-by-Step)

Step 1: Open S3 Console

• Go to AWS Console → S3 → Create bucket

Step 2: Configure Bucket Details

• Bucket name: my-demo-s3-bucket-123
• Region: ap-south-1 (Mumbai)

Step 3: Object Ownership

• ACLs disabled (recommended)
• Bucket owner enforced

Step 4: Block Public Access

• Keep all public access blocked (best practice)

Step 5: Create Bucket

4. Uploading Objects to S3

Ways to Upload

• AWS Console
• AWS CLI
• SDK (Python / Java / Go)

Example using AWS CLI

5. S3 Storage Classes

S3 provides different storage classes based on access frequency.

Storage Class	Use Case
S3 Standard	Frequently accessed data
S3 Intelligent-Tiering	Unknown access patterns
S3 Standard-IA	Infrequent access
S3 One Zone-IA	Non-critical data
S3 Glacier	Archival
S3 Glacier Deep Archive	Long-term archive

6. S3 Versioning

What is S3 Versioning?

S3 Versioning keeps multiple versions of the same object in a bucket instead of overwriting it.

If an object is:

• Updated → A new version is created
• Deleted → A delete marker is added (object is not permanently removed)

Why Versioning is Important?

• Protects against accidental deletion
• Helps in rollback and recovery
• Mandatory for CRR, SRR, Object Lock, MRAP

✅ Steps to Enable S3 Versioning

1. Open AWS Console → S3
2. Click on your bucket name
3. Go to Properties tab
4. Scroll to Bucket Versioning
5. Click Edit → Enable → Save changes

📌 Important: Once enabled, versioning cannot be disabled (only suspended).

Example Scenario

You can restore v1 or v2 anytime.

7. S3 Object Lock

What is S3 Object Lock?

S3 Object Lock prevents objects from being deleted or overwritten for a defined period of time.

Used mainly for:

• Compliance requirements
• Financial data
• Audit and security logs

Prerequisites

• Bucket must have versioning enabled
• Object Lock must be enabled during bucket creation
• Cannot be disabled once enabled

✅ Steps to Create a Bucket with Object Lock

1. Go to AWS Console → S3 → Create bucket
2. Enter bucket name and region
3. Expand Advanced settings
4. Enable Object Lock
5. Acknowledge warning
6. Create bucket

Object Lock Modes

1️⃣ Governance Mode

• Users with special IAM permission can delete objects
• Used for internal controls

2️⃣ Compliance Mode

• No one, including root user, can delete objects
• Used for regulatory compliance

✅ Steps to Apply Object Lock on an Object

1. Upload an object to the bucket
2. Select the object → Actions → Edit retention
3. Choose:
   • Governance or Compliance
   • Retain until date OR Legal Hold
4. Save changes

8. Cross-Region Replication (CRR)

What is Cross-Region Replication?

CRR automatically copies objects from a source bucket to a destination bucket in another AWS region.

Why CRR is Used?

• Disaster recovery
• Compliance
• Global availability

Prerequisites

• Versioning enabled on both buckets
• Buckets must be in different regions
• IAM role for replication

Architecture

✅ Steps to Configure Cross-Region Replication

1. Enable versioning on source and destination buckets
2. Open Source bucket → Management tab
3. Click Create replication rule
4. Rule name: crr-rule-1
5. Choose Apply to all objects (or prefix based)
6. Select Destination bucket (different region)
7. Create or select IAM replication role
8. Save the rule

📌 Only new objects are replicated automatically.

9. Same-Region Replication (SRR)

Definition

Replicates objects within the same AWS region.

Use Case

• Log aggregation
• Different storage classes
• Data separation

10. S3 Multi-Region Access Points (MRAP)

What is MRAP?

S3 Multi-Region Access Point (MRAP) provides a single global endpoint to access multiple S3 buckets across regions.

AWS automatically routes traffic to the nearest healthy bucket.

Why MRAP is Needed?

• Active–Active architecture
• Lowest latency access
• Automatic regional failover

How MRAP Works

Prerequisites

• At least two buckets in different regions
• Versioning enabled
• Replication (CRR or SRR)

✅ Steps to Create MRAP

1. Go to AWS Console → S3 → Multi-Region Access Points
2. Click Create MRAP
3. Provide MRAP name
4. Add buckets from different regions
5. Choose replication configuration
6. Create MRAP

How Applications Use MRAP

Applications do not need region-specific logic.

11. S3 Security Best Practices

Bucket Policies

• JSON-based access control

IAM Policies

• Fine-grained permissions

Encryption

• SSE-S3
• SSE-KMS
• Client-side encryption

Example Bucket Policy

12. S3 Lifecycle Policies

Definition

Automatically move objects between storage classes or delete them.

Example

• After 30 days → Standard-IA
• After 90 days → Glacier
• After 365 days → Delete

13. Real-Time Use Cases

• Application logs storage
• Data lake for ML
• Backup & restore
• Static website hosting
• Cross-region DR