Amazon S3 and Object Storage

Why this matters

Amazon S3 is one of the most used services in all of AWS, and it shows up constantly on the CLF-C02 exam. Almost every other service connects to it in some way: backups land in S3, data lakes are built on S3, logs are written to S3, and static websites are served from S3. If you understand S3 well, a large slice of the storage questions become easy.

S3 stands for Simple Storage Service. It is object storage, which is the first of three storage types you need to recognize for the exam. This lesson covers what object storage is, how S3 is organized, and the durability and security promises that make it the default place to put data on AWS.

Object, block, and file storage

There are three main ways to store data, and AWS has a service for each. Knowing the difference is a common exam point.

Object storage does not work like the drive in your laptop. You do not edit part of a file in place. Instead, you store, retrieve, and replace whole objects, and each object carries metadata that describes it. This design is what lets S3 scale to any amount of data while staying simple. The other two types, block and file, get their own lessons later in this topic.

How Amazon S3 is organized

S3 has only a few building blocks, and they are quick to learn.

A bucket is a container for your objects. You give it a name and pick an AWS Region when you create it, and you cannot change either afterward. General purpose bucket names live in a global namespace, so the name has to be unique across all AWS accounts, not just yours. Objects you store stay in the bucket's Region unless you choose to copy or replicate them elsewhere.

An object is a file plus the metadata that describes it. The metadata is a set of name-value pairs, such as the content type and the last-modified date, and you can add your own. A single object can be up to 5 TB, and a bucket can hold any number of objects, so total capacity is effectively unlimited.

A key is the unique name of an object inside its bucket. S3 uses a flat structure, but a key can contain slashes, so invoices/2026/january.pdf looks and behaves like a folder path even though there are no real folders underneath. The combination of bucket name and key points to exactly one object.

Bucket:  acme-reports          (globally unique name, in one Region)
  Object key:  invoices/2026/january.pdf   -> the PDF file + metadata
  Object key:  logs/access-2026-06-19.log  -> the log file + metadata

Durability and availability

S3 makes two promises that sound similar but mean different things, and the exam likes to test the difference.

Durability is about not losing your data. S3 Standard is designed for 99.999999999% durability, often called eleven nines. To reach that, S3 automatically stores copies of each object across at least 3 Availability Zones in the Region. If a disk or even a whole Availability Zone fails, your object is still safe. In practice, this means you can treat S3 as a place where data you put in stays put.

Availability is about being able to reach your data when you ask for it. S3 Standard is designed for 99.99% availability. A service can be extremely durable but briefly unavailable, so the two numbers measure different risks. Durability protects the bytes; availability protects your access to them.

Keeping data private

S3 buckets and objects are private by default. When you create a bucket, Block Public Access is turned on, which stops accidental exposure to the internet. Nothing is reachable until you explicitly grant access.

You control access in a few ways:

• IAM policies decide what your users and roles are allowed to do across AWS, including S3.
• Bucket policies are resource-based rules attached directly to a bucket, useful for granting access to specific principals or whole prefixes.
• Access control lists (ACLs) are an older mechanism, now disabled by default and rarely the right choice.

S3 also encrypts new objects at rest by default and supports encryption in transit. And with S3 Versioning, you can keep multiple versions of an object so you can recover from an accidental delete or overwrite. You do not need the deep details for the exam, but you should know that S3 is private and access-controlled out of the box.

Common use cases

S3 fits a wide range of jobs. The most common ones to recognize:

• Backup and restore, and long-term archive of data you must keep.
• Data lakes and big-data analytics, where huge datasets are queried in place.
• Static website hosting, serving HTML, images, CSS, and JavaScript directly.
• Media storage for images, video, and large files used by applications.
• Application data and logs, including content uploaded by users.

A simple rule for the exam: if a question describes storing files, objects, backups, or large unstructured data, and there is no need for a file system or a boot disk, the answer is almost always Amazon S3.

Exam tips

• Amazon S3 is object storage. Block storage is Amazon EBS, and file storage is Amazon EFS and Amazon FSx.
• A bucket is a container with a globally unique name, tied to one Region. An object is a file plus metadata, identified by a key.
• A single object can be up to 5 TB, and total storage is effectively unlimited.
• S3 Standard is designed for eleven nines (99.999999999%) of durability by storing data across at least 3 Availability Zones, and 99.99% availability.
• Durability means not losing data; availability means being able to reach it. They are different measures.
• Buckets are private by default, with Block Public Access on. You grant access with IAM policies, bucket policies, or access points.
• Reach for S3 when a scenario involves backups, archives, data lakes, static websites, or storing large files.