S3

Multipart upload splits one object into parts sent independently: CreateMultipartUpload returns an UploadId, UploadPart sends each numbered piece, CompleteMultipartUpload assembles them. Beyond the 5 GB ceiling it adds parallelism, per-part retry, and resumable uploads.

An S3 presigned URL is an object URL carrying a SigV4 signature and an expiry in its query string. Whoever holds it performs one specific operation on one specific object using the signing principal's permissions, with no AWS credentials of their own.

An S3 Lifecycle configuration is a set of bucket-level rules that act on objects automatically as they age. A rule takes one of two kinds of action: transition an object to a cheaper storage class, or expire (delete) it.

S3 erases nothing: it adds a delete marker as the new current version, so plain GETs return 404 while every earlier version stays stored and billed. You restore by deleting the delete marker by its own version ID.

S3 treats a grant to a wildcard principal or to the legacy AllUsers/AuthenticatedUsers groups as public unless conditions pin it to fixed values. Block Public Access has four independent switches that block or ignore public ACLs and public policies, and it applies at both account and bucket level.

SSE-S3 lets S3 hold the keys: free and invisible. SSE-KMS routes each object key through KMS, adding per-key control and an audit trail at a per-request cost. DSSE-KMS applies two layers for dual-encryption mandates. SSE-C makes you supply the key on every request.

S3 Event Notifications are at-least-once and not ordered. The same upload can produce two events and events for one key can arrive out of order, so the handler must be idempotent; the record's sequencer field lets you order events for the same key.

An S3 replication rule only applies to objects written after the rule is saved; it never walks the existing contents of the bucket. To copy the backlog you run S3 Batch Replication, an S3 Batch Operations job that replicates existing object versions using the same rule.

Small, short-lived and frequently-read objects. S3 Standard-IA bills a per-object minimum size and a 30-day minimum duration, and charges a per-GB retrieval fee, so tiny objects, objects deleted early, and hot data all cost more there than in S3 Standard.

Since December 2020, any successful S3 PUT or DELETE is immediately visible to every subsequent GET, HEAD and LIST, in all regions, at no extra cost. Bucket configuration changes and replication to another bucket remain eventually consistent.

S3 refuses overlapping notification configurations for one event type, so three consumers on the same prefix need a fan-out point: either one SNS topic with three subscribers, or EventBridge notifications with three independently filtered rules. EventBridge adds richer filtering, archive and replay, and cross-account routing.

Yes. Since January 2023 S3 encrypts every new object with SSE-S3 (AES-256) automatically and at no charge. That protects the data on AWS's disks; it does nothing against a caller whose IAM permissions already allow GetObject.

Attach a Filter with two key FilterRules on the notification configuration: prefix uploads/ and suffix .jpg. S3 only supports these two literal, case-sensitive string rules — there are no wildcards, no regular expressions, and no filtering on tags, size, or metadata.

Both are the same S3 replication feature and differ only in where the destination bucket lives. CRR copies objects to a bucket in another AWS Region for disaster recovery, lower read latency, or data-residency rules. SRR copies within one Region, typically across accounts or for log aggregation.

Cross-account S3 access needs two allows: the bucket policy in account A must permit account B's role, and an identity policy in account B must permit the same actions on that bucket. Either side alone is an implicit deny, so the request fails.

The S3 website endpoint is HTTP-only and needs a public bucket, but it maps directory paths to index documents and serves custom error pages. CloudFront with Origin Access Control keeps the bucket fully private, adds HTTPS on your own domain and caching, but does no directory-index mapping below the root.

S3 allows at most 10,000 parts, each at least 5 MiB except the last and at most 5 GiB. A 500 GB object therefore needs parts of roughly 50 MB or more; above that floor, larger parts mean fewer requests but more data re-sent per retry and more memory buffered per concurrent part.

Two clocks govern a presigned URL, and the shorter wins. Lambda signs with the execution role's temporary STS credentials, so the URL dies when that session expires, no matter what X-Amz-Expires says. SigV4 itself caps the requested expiry at seven days.

A presigned PUT pins the bucket, key and method into the signature, so the client cannot redirect the write — but it cannot bound the body size. A presigned POST signs a policy document whose conditions, including content-length-range, are enforced by S3 on upload.

With legacy ACLs enabled, an object is owned by the account that uploaded it, not by the bucket owner, so a cross-account writer's objects can be unreadable by the bucket's own account. Setting Object Ownership to BucketOwnerEnforced disables ACLs and makes the bucket owner own every object.

Add a Deny statement on all S3 actions when aws:PrincipalOrgID does not equal your organization ID. The trap is that AWS service principals do not carry that key, so log delivery and other service writes break unless you exempt them with aws:PrincipalIsAWSService.

Each read of an SSE-KMS object costs a KMS decrypt request, so object throughput becomes KMS throughput and hits the account's per-Region KMS request quota. S3 Bucket Keys let S3 derive object keys from a short-lived bucket-level key, cutting KMS calls sharply.

Attach two Deny statements to the bucket policy: deny s3:PutObject unless the s3:x-amz-server-side-encryption condition equals aws:kms, and deny s3:* when aws:SecureTransport is false, listing both the bucket ARN and the object ARN.

The output write fires the same notification, so the function invokes itself in an unbounded loop that burns concurrency, S3 request charges and Lambda duration until someone stops it. Fix it by writing output to a different bucket, or by fencing input and output with disjoint prefix or suffix filters.

Abandoned multipart uploads. Parts from uploads that were never completed or aborted are stored and billed but never appear in an object listing. Find them with ListMultipartUploads and stop the bleeding with a lifecycle rule using the AbortIncompleteMultipartUpload action.

S3 scales request rate per key prefix, not per bucket: roughly 3,500 write and 5,500 read requests per second each. Spread keys across many prefixes to multiply that ceiling, and retry 503 SlowDown with exponential backoff plus jitter while S3 repartitions.

A presigned URL is a bearer token that S3 never recorded: validity is recomputed from the signature, the expiry and the signer's current permissions on every request. With nothing to revoke individually, you must deny the object, remove the signer's permission, kill the signing session, or move the object.

SSE-KMS objects are excluded unless the rule opts them in via SourceSelectionCriteria, and the replication role needs kms:Decrypt on the source key plus kms:Encrypt on a destination-Region key named in the rule. Cross-account also needs both key policies and the destination bucket policy to allow that role.

S3 replication optionally propagates delete markers if the rule enables delete-marker replication, but it never propagates a DELETE that names a specific version ID. Replication mirrors live state rather than preserving history, so it protects against losing a Region or a bucket, not against a person or process destroying data.