AWS & SRE Field Manual (Part 6): Amazon S3 Architecture, Security Boundaries & Lifecycle Engineering

1. TL;DR & Problem Statement

• Definition: An industry-standard, serverless object storage service offering virtually unlimited scalability, high availability, advanced security guardrails, and 99.999999999% (11 9's) data durability. It stores data as discrete objects containing payload bytes, customizable metadata, and a globally unique identifier (GUID) rather than block storage (EBS) or directory file hierarchies (EFS).
• Problem Solved: Eliminates disk capacity limits, physical storage maintenance, and high infrastructure costs associated with traditional file systems; makes petabyte-scale unstructured data (static web assets, application logs, backups, and analytical data lakes) addressable and retrievable directly over HTTPS.
• Category: Storage / Object Storage

---

2. Core Architecture & Key Components

                             Client Request (HTTPS)
                                       │
                    ┌──────────────────┴──────────────────┐
                    ▼                                     ▼
        Public Internet (BPA Protected)         VPC Gateway Endpoint
                    │                               (Private Backbone)
                    └──────────────────┬──────────────────┘
                                       │
                                       ▼
                       ┌───────────────────────────────┐
                       │       Amazon S3 Bucket        │
                       │   (Global Unique Namespace)   │
                       └───────────────┬───────────────┘
                                       │
        ┌──────────────────────────────┼──────────────────────────────┐
        ▼                              ▼                              ▼
┌──────────────┐               ┌──────────────┐               ┌──────────────┐
│ S3 Standard  │ ──(Day 30)──► │ Standard-IA  │ ──(Day 90)──► │ Glacier Flex │
│ (Active Hot) │               │ (Cool Data)  │               │  (Deep Cold) │
└──────────────┘               └──────────────┘               └──────────────┘

2.1. Buckets & Global Namespace Architecture

• Top-level logical containers for object storage.
• While physically hosted in a specific AWS Region, bucket names share a globally unique namespace across all AWS accounts worldwide.
• Addressing: Objects are deterministically addressed via ARNs or standardized HTTPS URLs:
  • arn:aws:s3:::my-production-source-repo/app/config.json
  • https://my-production-source-repo.s3.amazonaws.com/app/config.json

2.2. S3 Storage Classes & Cost-Performance Spectrum

• S3 Standard: High-throughput, low-latency storage for actively accessed data (web assets, dynamic application files).
• S3 Standard-IA (Infrequent Access): For data accessed less frequently but requiring millisecond retrieval times. Features lower base storage pricing but incurs per-GB data retrieval fees.
• S3 Glacier Flexible / Deep Archive: Ultra-low-cost archival tiers for long-term compliance data. Retrieval latencies range from minutes to 12+ hours.
• S3 Intelligent-Tiering: Automatically optimizes storage costs by continuously monitoring object access patterns and moving objects between frequent and infrequent tiers without performance impact or retrieval fees.

2.3. S3 Lifecycle Configuration Engine

• Declarative automation rules that transition aging objects to cheaper storage classes (Transitions) or permanently purge them (Expiration).
• Example Lifecycle Flow: Day 0: S3 Standard -> Day 30: Standard-IA -> Day 90: Glacier Flexible -> Day 365: Permanent Expiration.

2.4. S3 Versioning & MFA Delete

• Retains previous versions of an object with a unique Version ID when overwritten, rather than destroying the underlying data.
• Acts as the primary defense against accidental deletion, malicious writes, and ransomware. MFA Delete can be enforced to prevent permanent version destruction or versioning state changes without hardware token approval.

2.5. S3 Object Lock (WORM — Write Once, Read Many)

• Enforces compliance and regulatory retention mandates (SEC Rule 17a-4, HIPAA) by preventing objects from being deleted or overwritten for a fixed retention period, even by the AWS Root account (Compliance Mode).

2.6. Replication Patterns (CRR / SRR)

• Cross-Region Replication (CRR): Automatically and asynchronously copies objects across distinct AWS Regions for multi-region disaster recovery (DR) and localized latency reduction.
• Same-Region Replication (SRR): Synchronizes objects across accounts or buckets within the same AWS Region for centralized logging and test/production environment isolation.

2.7. Pre-Signed URLs

• Cryptographically signed, time-limited URLs (e.g., valid for 15 minutes) that grant temporary read or write permissions to unauthenticated clients (e.g., allowing a mobile app to upload a profile avatar directly to S3) without consuming application server compute or network bandwidth.

---

3. Deep Dive Engineering & Critical Security Controls

S3 Block Public Access (BPA)

• An account-level and bucket-level circuit breaker that unconditionally overrides permissive ACLs and bucket policies, preventing accidental exposure of sensitive buckets to the public internet.

VPC Gateway Endpoints

• Routes all S3 traffic originating from EC2, ECS, or EKS workloads directly through AWS's internal private network backbone.
• Eliminates NAT Gateway data processing fees, prevents egress traffic over the public internet, and enforces strict endpoint boundary policies.

Strong Read-After-Write Consistency

• Amazon S3 automatically provides strong read-after-write consistency for PUT and DELETE requests of objects in all AWS Regions with zero eventual-consistency replication lag.

---

4. Practical Notes & Configuration Snippets

S3 Bucket Policy (Restricting Ingress to Specific IAM Role and VPC Endpoint)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictToVPCAndRole",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/EKS-App-Pod-Role"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-production-source-repo/*",
      "Condition": {
        "StringEquals": {
          "aws:sourceVpce": "vpce-0123456789abcdef0"
        }
      }
    }
  ]
}

Essential AWS CLI Commands for S3

# Sync local directory to S3 bucket efficiently (copies only changed files)
aws s3 sync ./build-artifacts s3://my-production-source-repo/builds/ --delete

# Generate a pre-signed URL for temporary object upload (valid for 15 minutes)
aws s3 presign s3://my-production-source-repo/uploads/user-avatar.png --expires-in 900

# Enable versioning on a bucket
aws s3api put-bucket-versioning \
  --bucket my-production-source-repo \
  --versioning-configuration Status=Enabled

---

5. Gotchas & Common Pitfalls

• Small File Lifecycle Transition Costs: Transitioning objects smaller than 128 KB to Standard-IA or Glacier is uneconomical. S3 bills storage for a minimum of 128 KB per object, and the per-request transition API costs often exceed the storage savings.
• Delete Markers in Versioned Buckets: Issuing a simple DELETE request against a versioned object does not physically delete the data; it simply places a zero-byte Delete Marker on top of the version stack. To reclaim storage capacity, you must delete the explicit Version ID or configure Lifecycle rules to purge expired object delete markers.
• KMS API Throttling with SSE-KMS: Encrypting high-velocity buckets with standard AWS KMS keys can hit default account KMS request rate limits (throttling) under high RPS workloads. Enable S3 Bucket Keys to reduce KMS API calls by up to 99%.

---

6. Production Best Practices

• Enforce In-Transit Encryption (aws:SecureTransport): Add an explicit Deny statement in your bucket policy for any request where "aws:SecureTransport": "false" to reject non-HTTPS connections unconditionally.
• S3 Inventory over ListObjectsV2: For buckets holding millions of objects, running ListObjectsV2 API scans introduces extreme latency and high request fees. Use S3 Inventory to output daily or weekly CSV/Parquet metadata reports directly to S3.
• Abort Incomplete Multipart Uploads: Large file uploads (greater than 100 MB) use multipart chunking. Always configure a bucket lifecycle rule to automatically abort and clean up failed, partial multipart uploads after 7 days to eliminate hidden orphan storage costs.