S3

The lifecycle rule transitioned those objects into S3 Glacier Flexible Retrieval or Deep Archive, which cannot be read by GetObject at all. You must first issue a RestoreObject request and wait, or move the data to S3 Glacier Instant Retrieval, which serves GETs directly.

On a versioned bucket, an Expiration rule only makes the current version noncurrent by adding a delete marker; the bytes stay as noncurrent versions and keep billing. Add NoncurrentVersionExpiration, plus a rule with ExpiredObjectDeleteMarker to sweep the markers.

Enable S3 Object Lock on the versioned bucket with a seven-year default retention in compliance mode, so no principal — including the account root user — can shorten it or delete a protected version. Governance mode is the reversible, testable alternative.

Choose Intelligent-Tiering when access patterns are unknown or changing: it moves objects between tiers on observed access and charges no retrieval fees, for a per-object monitoring fee. Choose explicit lifecycle rules when the pattern is known and deterministic, or when objects are tiny.

With SSE-C you send the key on every request; S3 uses it, discards it, and keeps only a randomly salted HMAC to validate later requests. HTTPS is mandatory, a lost key means a lost object, and clients that cannot send custom headers cannot read it.

A byte-range GET sends a Range header on GetObject so S3 returns only those bytes, with HTTP 206 Partial Content. Use it to download one object in parallel chunks, to resume an interrupted download, or to read a small region such as a file footer.

Nothing is wrong with the signature — curl proves that. The bucket has no CORS configuration permitting your page's origin and the PUT method, so the browser blocks the cross-origin request. Fix it by putting a CORS configuration on the bucket.

Suspending stops S3 from minting new version IDs: every later upload to a key is stored with the literal version ID null and overwrites the previous null version. Versions created while versioning was enabled are kept and still billed.

Default S3 replication is best-effort with no time commitment. Replication Time Control adds a service level agreement covering replication of 99.99% of objects within 15 minutes, for an extra per-GB charge, and surfaces replication metrics and events so breaches are visible.

Archiving is billed per object, not just per gigabyte. Glacier Flexible Retrieval and Deep Archive add fixed per-object metadata overhead, each transition is a paid request, and Deep Archive carries a 180-day minimum duration — so hundreds of millions of tiny objects lose on every axis.

An S3 Access Point is a named endpoint attached to a bucket, with its own hostname, its own policy and its own Block Public Access settings. Each consumer gets one, so per-consumer rules live in many small policies instead of one growing bucket policy.

Keep a raw immutable landing zone separate from curated output, partition prefixes by a stable dimension such as source and ingestion date, and aggregate events into files of tens to hundreds of megabytes instead of millions of tiny objects. Reorganising a lake later means copying everything.