S3

Public Access Control

• •Default deny public access—only open when explicitly needed (static hosting)
• •Bucket policy vs IAM: bucket policy for cross-account/public, IAM for same-account roles
• •Check both bucket-level AND account-level block settings—account can override bucket
• •For web assets, prefer CDN in front of bucket over direct public access

Presigned URLs

• •Set shortest expiration practical—minutes for immediate use, not days
• •URL is a bearer token—anyone with it has access; treat as secret
• •Specify HTTP method in signature—GET for download, PUT for upload
• •Include Content-Type for uploads—mismatch between signature and request causes 403
• •Generate server-side, never expose credentials to client

Lifecycle Rules

• •Transition to cheaper tiers for infrequent access—but check minimum storage duration penalties
• •Auto-delete for temp files, logs, old versions—prevents unbounded storage growth
• •Clean incomplete multipart uploads—accumulate invisibly; set abort rule (7 days typical)
• •Versioned buckets: separate rules for current vs noncurrent versions

Versioning Behavior

• •Enable before you need it—can't recover deleted objects without versioning
• •"Delete" creates delete marker—object hidden but versions remain; storage still consumed
• •Permanent deletion requires explicit version ID—without it, just adds marker
• •Noncurrent version expiration essential—otherwise old versions accumulate forever

Multipart Uploads

• •Required above 5GB, recommended above 100MB—single PUT has size limits
• •Incomplete uploads invisible in normal listings—consume storage silently
• •Abort incomplete uploads via lifecycle—or manually with list-multipart-uploads
• •Parallel part uploads for speed—parts can upload concurrently

CORS for Browser Access

• •Required for JavaScript direct upload/download—blocked without CORS headers
• •Specify exact origins—avoid wildcard * for authenticated requests
• •Expose headers that JavaScript needs to read—Content-Length, ETag, custom headers
• •AllowedMethods: GET for download, PUT for upload, DELETE if needed

Key Naming

• •Use prefixes like directories: users/123/avatar.jpg—but S3 is flat, not hierarchical
• •Avoid sequential prefixes for high throughput—2024-01-01/file1 can hotspot
• •Random prefix or hash for write-heavy buckets—distributes across partitions
• •No leading slash—/images/file.jpg creates empty-string prefix

Cost Awareness

• •Request volume matters—many small files more expensive than few large files
• •Egress typically costly—CDN reduces egress by caching at edge
• •Minimum storage duration varies by tier—early deletion still charged full period
• •Lifecycle transitions have per-object cost—millions of tiny files expensive to transition

Replication

• •Cross-region for disaster recovery, same-region for compliance copies
• •Versioning required on both source and destination
• •Only new objects replicate—existing objects need manual copy or batch operation
• •Delete markers not replicated by default—explicitly enable if needed

Provider Differences

• •AWS S3: full feature set, most tools assume AWS behavior
• •Cloudflare R2: no egress fees, subset of features
• •Backblaze B2: S3-compatible API, different pricing model
• •MinIO: self-hosted, full S3 API compatibility
• •Check presigned URL compatibility—some providers have quirks