Guides

AWS S3 Interview Questions and Answers: 30 Questions With Scenarios

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

Here are 30 Amazon S3 interview questions with short answers, from basics to real scenarios. Know these numbers by heart: objects up to 5 TB (single PUT up to 5 GB), strong consistency since December 2020, Block Public Access on for new buckets since April 2023, and SSE-S3 encryption by default since January 2023. Then practise the classic scenario: "a user gets 403 AccessDenied".

A live example first

Scenario: "A developer's role can list the bucket but gets 403 when downloading reports/oct.pdf." We walk through it:

aws s3 ls s3://rb-reports-2026/reports/        # works
aws s3 cp s3://rb-reports-2026/reports/oct.pdf .

download failed: An error occurred (AccessDenied) when calling the GetObject operation

1. IAM policy: has s3:ListBucket on the bucket, but s3:GetObject must be on arn:aws:s3:::rb-reports-2026/* (objects, not the bucket). Here it was missing the /*.
2. Bucket policy: no explicit deny for this role.
3. Encryption: the object uses SSE-KMS, so the role also needs kms:Decrypt on that key.

After fixing the resource ARN and adding kms:Decrypt, the download works. Friends, "bucket ARN vs object ARN" is a favourite interview trap.

How an object is protected

Basics

Q1. What is Amazon S3?

Object storage: you store files (objects) in buckets and get them by key over HTTPS. It is built for 99.999999999% (11 nines) durability.

Q2. What is the maximum object size?

5 TB per object. A single PUT can upload up to 5 GB; larger files need multipart upload, which is recommended above about 100 MB.

Q3. Are bucket names global?

Yes. Bucket names are unique across all AWS accounts in a partition, though each bucket lives in one Region.

Q4. Is S3 strongly consistent?

Yes. Since December 2020, S3 gives strong read-after-write consistency for all PUT, DELETE and LIST operations, at no extra cost.

Q5. What is a prefix?

The part of the key before the file name, like logs/2026/10/. S3 has no real folders; the console shows prefixes as folders.

Q6. What is S3 Versioning?

It keeps every version of an object, so overwrites and deletes can be undone. Once enabled it can only be suspended, not removed.

Storage classes and cost

Q7. Name the main storage classes.

S3 Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval and Glacier Deep Archive.

Q8. When use Intelligent-Tiering?

When access patterns are unknown or change. It moves objects between tiers automatically for a small monitoring fee per object.

Q9. What is a lifecycle rule?

A rule that moves objects to cheaper classes or deletes them after a number of days, for example logs to Glacier after 90 days and delete after 365.

Q10. What is the catch with Standard-IA?

Cheaper storage, but a per-GB retrieval fee and a 30-day minimum storage charge. Good for backups that are rarely read.

Q11. How do you find what is costing money in S3?

Use S3 Storage Lens, Cost Explorer by usage type, and check for old versions, incomplete multipart uploads and data transfer out.

Q12. What are incomplete multipart uploads?

Parts of uploads that never finished. They are billed but invisible in normal listings. Add a lifecycle rule to abort them after 7 days.

Security

Q13. How do you keep a bucket private?

Keep Block Public Access on (default for new buckets since April 2023), keep ACLs disabled (Bucket owner enforced), and grant access with IAM and bucket policies.

Q14. Bucket policy vs IAM policy?

A bucket policy is attached to the bucket and can grant access to other accounts or services. An IAM policy is attached to a user or role. Access needs an allow and no explicit deny.

Q15. How is data encrypted?

All new objects are encrypted at rest by default with SSE-S3 (since January 2023). You can choose SSE-KMS for key control and audit, or encrypt on the client side.

Q16. How do you force HTTPS?

Add a bucket policy that denies requests where aws:SecureTransport is false.

Q17. How do you share a private file for a short time?

Generate a presigned URL with an expiry, up to 7 days with IAM user keys.

Q18. What is Object Lock?

Write-once-read-many (WORM) protection. Objects cannot be deleted or changed until the retention date, even by admins in compliance mode. Useful against ransomware.

Features

Q19. How do you host a static website?

Upload files to a bucket and put CloudFront in front with Origin Access Control, so the bucket stays private and you get HTTPS.

Q20. What is Cross-Region Replication?

Automatic copying of new objects to a bucket in another Region, for disaster recovery or lower latency. Versioning must be on in both buckets.

Q21. What are S3 event notifications?

S3 can send events (like ObjectCreated) to Lambda, SQS, SNS or EventBridge, for example to make thumbnails when an image is uploaded.

Q22. What is S3 Transfer Acceleration?

Uploads go to the nearest CloudFront edge and travel over the AWS network to the bucket, helping users far from the bucket's Region.

Q23. aws s3 cp vs sync?

cp copies what you name; sync copies only new or changed files and can delete extras with --delete.

Q24. What is S3 Select / querying data in place?

S3 Select can filter one CSV or JSON object with SQL, and Amazon Athena can query many objects with SQL without loading them into a database.

Scenarios

Q25. A user gets 403 AccessDenied on an object. What do you check?

1. IAM policy allows s3:GetObject. 2. Bucket policy has no deny. 3. KMS key policy allows decrypt if SSE-KMS. 4. Right Region and key name. 5. Object owner (if ACLs are still enabled).

Q26. Someone deleted important files. How could you have prevented or recovered it?

Versioning (restore the previous version or remove the delete marker), MFA delete or Object Lock, and Cross-Region Replication or AWS Backup to another account.

Q27. The bill for S3 suddenly rose. Steps?

Check Cost Explorer by usage type: storage, requests or data transfer. Look for public downloads, a loop of event triggers, old versions and incomplete uploads.

Q28. Users in the US see slow downloads from a Mumbai bucket.

Put CloudFront in front to cache near users, or replicate to a US bucket. Transfer Acceleration helps uploads.

Q29. You need logs kept 7 years and rarely read. Design?

Store in S3 with a lifecycle rule to Glacier Deep Archive, Object Lock for compliance, and a separate account for the log archive.

Q30. An app uploads millions of small files and is slow. What helps?

Spread keys across prefixes (S3 scales per prefix, about 3,500 writes and 5,500 reads per second each), batch files where possible, and use parallel uploads.

Summary table

Real example

In 2017, the S3 outage in us-east-1 (February 28) happened when an engineer's command, meant to remove a small number of servers, removed many more, and many websites and apps went down for hours. AWS's write-up explained that they added safeguards so capacity could not be removed too fast. In interviews this is a good story for "why use Cross-Region Replication and design for Region failure".