14. Amazon S3: Buckets, Objects, Policies and Presigned URLs
14.1 What S3 Is: Buckets, Objects and Keys
S3 mhanje internet var ek unlimited "file store". Pan to normal disk sarkha nahi – tyat folders nastat, fakt buckets aani objects astat. Ekdum simple chitra doktyat theva:
| Term | Meaning | Example |
|---|---|---|
| Bucket | Top-level container, name is globally unique across all AWS accounts | ravindra-reels-media-pune |
| Object | One file plus its metadata (content type, size, tags) | a video, an image, a PDF |
| Key | The full "path" name of the object inside the bucket | videos/2026/09/a1b2c3.mp4 |
| Prefix | The part of the key before the last / – the console shows it as a folder |
videos/2026/09/ |
| Region | Where the bucket physically lives; choose one close to your users | ap-south-1 (Mumbai) |
| Storage class | Price/speed trade-off for the object | Standard, Standard-IA, Glacier |
s3://ravindra-reels-media-pune/videos/2026/09/a1b2c3.mp4
└────────── bucket ─────────┘└───────────── key ─────────────┘
Object la URL pan asto: https://<bucket>.s3.<region>.amazonaws.com/<key>. Pan URL aahe mhanje to public aahe asa nahi – by default pratyek bucket aani object private asto. Ha niyam lakshat theva.
| Feature | EBS (disk on EC2) | S3 (object storage) |
|---|---|---|
| Attached to | One EC2 instance | Nothing – reached over HTTPS API |
| Size | You choose and pay for the full disk | Grows automatically, pay for what you store |
| Access | Through the operating system (ls, cp) |
Through API/CLI/SDK (aws s3 cp) |
| Best for | OS, databases, application code | Uploads, videos, images, backups, logs, static sites |
Why this matters for security
Because every object has a URL, a single wrong permission makes files downloadable by anyone on the internet – no login, no hacking skill needed. Many publicly reported data leaks were simply S3 buckets or objects left readable to "Everyone". Attackers even guess bucket names (companyname-backup, companyname-dev) and try them automatically.
Ravindra Bagale's Tip
Khup students bucket la folder samajtat aani pratyek project sathi test, mybucket asa naav detat – ani "name already exists" error yeto. Bucket che naav sagla jagat unique asta. Project, purpose aani city/region jodun naav dya, jase ravindra-reels-media-pune. Aani naavat secret mahiti (client naav, "backup", "passwords") kadhi theu naka – bucket names publicly guess kele jatat.
Practice task
Write down three bucket names for a project of your own following the rule project-purpose-place. Then split the key invoices/pune/2026/inv-101.pdf into prefix and file name.