S3 buckets, objects, policies, versioning and lifecycle

Why and what

An object contains bytes, metadata and a key inside a bucket. A key such as reels/video-123.mp4 is an object name, not a real nested disk directory. Choose the bucket Region near the application and use a unique name that does not reveal sensitive information. Object size, requests, retrieval class and transfer affect cost.

Private-bucket lab

1. Create a general-purpose bucket in the lab Region. Keep Block Public Access enabled and ACLs disabled with bucket-owner-enforced ownership.
2. Review default encryption. SSE-S3 and SSE-KMS have different control, policy and cost implications.
3. Enable versioning for recovery exercises. Upload lesson.txt, edit it locally and upload again under the same key.
4. List versions in the console and restore an earlier version by copying it into the current version.
5. Add a lifecycle rule for the lab prefix only, including noncurrent versions and incomplete multipart uploads when appropriate.

aws s3 cp lesson.txt s3://YOUR_UNIQUE_BUCKET/reels/lesson.txt
aws s3api head-object --bucket YOUR_UNIQUE_BUCKET --key reels/lesson.txt
aws s3 presign s3://YOUR_UNIQUE_BUCKET/reels/lesson.txt --expires-in 300

The presigned URL should work temporarily without making the bucket public. A normal unsigned object URL should fail for a private object. Do not paste signed URLs into public logs or course examples containing real private data.

Important distinctions

Versioning is not the same as replication or an immutable backup. Deletion in a versioned bucket can add a delete marker while older versions remain billable. Lifecycle transitions can have minimum-duration/retrieval charges. Object Lock is a separate retention feature; test its implications before enabling irreversible governance requirements. CORS is a browser permission mechanism, not authentication. The capstone sends uploads through its server and returns signed GET URLs, so it does not require broad browser upload CORS permissions. A direct-to-S3 upload design would require scoped CORS, authorization and server-side validation of completion.

Static hosting

S3 website endpoints have different behaviour from S3 REST origins. For private-origin HTTPS distribution use CloudFront with an S3 REST origin and OAC; do not use a website endpoint with OAC. Avoid turning off Block Public Access just to fix a mistaken origin configuration.

Practice and cleanup

Recover an overwritten file and explain why a simple delete did not erase every version. To remove the lab bucket, deliberately remove versions and delete markers first; do not automate account-wide deletion.

Official references

S3 versioning S3 lifecycle S3 public access controls

Interview and revision check

Does CORS make a private object publicly readable?

No. CORS controls browser cross-origin behaviour. S3 authorization still evaluates IAM, policies and signed access.