DEV Community

Cover image for AWS S3: A Practical Beginner’s Guide to Amazon Simple Storage Service
Muhammad Rizwan
Muhammad Rizwan

Posted on

AWS S3: A Practical Beginner’s Guide to Amazon Simple Storage Service

#aws #devops #tutorial #cloud

1. Introduction

If you're starting your journey into AWS, Cloud Computing, or DevOps, there's a very good chance the first service you'll touch i s Amazon S3 (Simple Storage Service). It's one of the oldest, most widely used, and most beginner-friendly services AWS offers — and understanding it well will make almost everything else in AWS easier to learn.

In this guide, we'll break down S3 from the ground up: what it is, how it works, how to create and use buckets, how to secure your data, and how to complete a small hands-on project. No prior AWS experience is required — just curiosity and a free-tier AWS account.

By the end of this article, you'll be comfortable creating buckets, uploading files, using the AWS CLI, and applying basic security best practices.

2. What is Amazon S3?

Amazon S3 (Simple Storage Service) is a fully managed object storage service provided by AWS. It allows you to store and retrieve any amount of data, at any time, from anywhere on the web.

Unlike traditional file systems that organize data in folders and directories on a single disk, S3 stores data as objects inside logical containers called buckets. This design makes S3:

  • Highly durable — AWS designs S3 for 99.999999999% (11 nines) durability of objects over a given year
  • Highly scalable — you don't provision storage capacity; it grows automatically
  • Cost-effective — you pay only for what you use
  • Accessible — objects can be retrieved via HTTPS, the AWS CLI, SDKs, or the AWS Console

Common use cases include storing website assets, backups, application data, logs, media files, and serving as the foundation for data lakes.

💡 Note: S3 is not a traditional file system or block storage like Amazon EBS. It's built for storing independent objects, not for running an operating system or a database directly on it.

3. How S3 Works

At a high level, S3 works like this:

  1. You create a bucket (a container for your data).
  2. You upload files into that bucket — each file becomes an object.
  3. Every object is identified by a unique object key within the bucket.
  4. You (or your application) can then read, update, or delete objects using the AWS Console, CLI, SDKs, or REST API.

Graphic 1 — How S3 Works

Image Prompt: A simple, clean horizontal flow diagram with four connected stages: a "User" icon (laptop/person), an arrow pointing to an "AWS S3" cloud icon, an arrow pointing to a "Bucket" icon (a labeled storage container), and a final arrow pointing to three small object icons labeled image.jpg, document.pdf, and backup.zip. Flat vector style, AWS orange and blue color palette, minimal and professional, white background.

Caption: A simplified flow of how data moves from a user into an S3 bucket as objects.

Placement: Immediately after this section's introduction, before Section 4 (S3 Bucket).

This simplicity is what makes S3 so powerful — there's no server to manage, no storage capacity to plan for, and no complex configuration required to get started.

4. S3 Bucket

A bucket is the top-level container in S3 where your objects are stored. Think of it as a highly durable, infinitely scalable "root folder" in the cloud.

Key facts about buckets:

  • Bucket names must be globally unique across all of AWS (not just your account)
  • Bucket names must be lowercase, 3–63 characters, and follow DNS naming rules
  • Each bucket is created in a specific AWS Region
  • You can store an unlimited number of objects in a bucket
  • Buckets have their own permissions, policies, and configuration settings

Example of a valid bucket name:

my-devto-s3-demo-bucket-2026
Enter fullscreen mode Exit fullscreen mode

⚠️ Warning: Because bucket names are globally unique, avoid using predictable or generic names for production workloads — attackers sometimes scan for common bucket names to find misconfigured public buckets.

5. S3 Object

An object is the actual piece of data you store in S3 — essentially, a file plus some metadata. Every object consists of:

  • Data — the actual file content (image, document, video, backup, etc.)
  • Metadata — a set of name/value pairs describing the object (content type, size, last modified date, custom tags, etc.)
  • Object Key — the unique identifier for that object within the bucket

Objects can range in size from 0 bytes to 5TB, and a single bucket can hold virtually unlimited objects.

6. Object Key

The object key is the unique name that identifies an object inside a bucket. S3 doesn't have real folders — instead, it uses key prefixes that simulate a folder structure.

For example, if you upload a file with the key:

images/2026/vacation-photo.jpg
Enter fullscreen mode Exit fullscreen mode

The AWS Console will display this as if it's inside folders named images and 2026, but internally, S3 just stores it as one flat object with that full key string.

Concept Traditional File System Amazon S3
Storage unit File Object
Location identifier File path Object key
Folder structure Real, nested directories Simulated via key prefixes
Access method Local/network file access HTTPS, CLI, SDK, REST API

7. Creating an S3 Bucket

You can create a bucket using the AWS Console, AWS CLI, or Infrastructure as Code tools like CloudFormation or Terraform. Let's start with the Console approach, then move to the CLI.

Steps using the AWS Console:

  1. Sign in to the AWS Management Console
  2. Navigate to the S3 service
  3. Click Create bucket
  4. Enter a globally unique bucket name
  5. Choose an AWS Region close to your users
  6. Keep Block all public access enabled (default and recommended)
  7. Click Create bucket 
[SCREENSHOT PLACEHOLDER: AWS S3 "Create bucket" configuration screen]
Enter fullscreen mode Exit fullscreen mode

This screenshot should show the S3 console's bucket creation form, including fields for bucket name, AWS Region selection, and the "Block Public Access settings" section with all four options checked (enabled) by default.

Creating a bucket using the AWS CLI:

aws s3 mb s3://my-devto-s3-demo-bucket-2026 --region us-east-1
Enter fullscreen mode Exit fullscreen mode

✅ This command creates a new bucket named my-devto-s3-demo-bucket-2026 in the us-east-1 region.

8. Uploading a File

Once your bucket exists, you can upload files (objects) into it.

Using the AWS Console:

  1. Open your bucket
  2. Click Upload
  3. Select your file(s)
  4. Click Upload 
[SCREENSHOT PLACEHOLDER: AWS S3 bucket "Upload" screen showing selected files ready to upload]
Enter fullscreen mode Exit fullscreen mode

This screenshot should show the file upload interface with a selected file listed, along with the "Upload" button.

Using the AWS CLI:

aws s3 cp ./example.txt s3://my-devto-s3-demo-bucket-2026/example.txt
Enter fullscreen mode Exit fullscreen mode

This uploads example.txt from your local machine into the bucket, using example.txt as the object key.

9. AWS CLI Commands for S3

Here are the most common AWS CLI commands you'll use when working with S3.

List all buckets:

aws s3 ls
Enter fullscreen mode Exit fullscreen mode

Create a bucket:

aws s3 mb s3://my-devto-s3-demo-bucket-2026
Enter fullscreen mode Exit fullscreen mode

Upload a file:

aws s3 cp ./file.txt s3://my-devto-s3-demo-bucket-2026/file.txt
Enter fullscreen mode Exit fullscreen mode

List objects in a bucket:

aws s3 ls s3://my-devto-s3-demo-bucket-2026
Enter fullscreen mode Exit fullscreen mode

Download a file:

aws s3 cp s3://my-devto-s3-demo-bucket-2026/file.txt ./file.txt
Enter fullscreen mode Exit fullscreen mode

Delete an object:

aws s3 rm s3://my-devto-s3-demo-bucket-2026/file.txt
Enter fullscreen mode Exit fullscreen mode

Sync a local directory with a bucket:

aws s3 sync ./local-folder s3://my-devto-s3-demo-bucket-2026/backup-folder
Enter fullscreen mode Exit fullscreen mode

💡 Tip: aws s3 sync only uploads files that are new or have changed, making it ideal for backups and repeated deployments.

10. S3 Storage Classes

S3 offers multiple storage classes so you can optimize cost based on how frequently you access your data.

Storage Class Best For Availability Notes
S3 Standard Frequently accessed data High Default choice for active workloads
S3 Intelligent-Tiering Unpredictable access patterns High Automatically moves data between tiers
S3 Standard-IA (Infrequent Access) Data accessed less often but needed quickly High Lower storage cost, retrieval fee applies
S3 One Zone-IA Infrequent, non-critical data Single AZ Cheaper, but less resilient
S3 Glacier Instant Retrieval Archival data needing millisecond access High Low-cost archival with fast retrieval
S3 Glacier Flexible Retrieval Long-term archives, rare access High Retrieval takes minutes to hours
S3 Glacier Deep Archive Rarely accessed, long-term compliance data High Lowest cost, retrieval takes hours

Graphic 3 — S3 Storage Classes

Image Prompt: A clean infographic with seven vertically stacked or horizontally arranged cards, each representing an S3 storage class (Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive). Each card uses a simple icon (lightning bolt for fast access, snowflake for cold storage, clock for retrieval time) and a short label. Flat design, consistent AWS-style color palette, professional and easy to scan.

Caption: A quick visual comparison of S3 storage classes based on access frequency and cost.

Placement: Directly below this section's table.

💡 Tip: Start with S3 Standard while learning, and explore other classes once you understand real access patterns for your data.

11. S3 Versioning

Versioning allows S3 to keep multiple versions of the same object in a bucket. This protects against accidental overwrites and deletions.

When versioning is enabled:

  • Every update to an object creates a new version instead of overwriting it
  • Deleting an object adds a delete marker instead of permanently removing it
  • You can restore any previous version at any time

Enable versioning via CLI:

aws s3api put-bucket-versioning \
  --bucket my-devto-s3-demo-bucket-2026 \
  --versioning-configuration Status=Enabled
Enter fullscreen mode Exit fullscreen mode

⚠️ Warning: Versioning increases storage usage (and cost) since old versions are retained. Combine it with lifecycle rules to automatically clean up old versions.

12. S3 Lifecycle Rules

Lifecycle rules automate the process of transitioning or deleting objects over time, helping you manage costs without manual effort.

Common lifecycle actions:

  • Transition objects to a cheaper storage class after a certain number of days
  • Permanently delete objects after a retention period
  • Clean up old object versions (if versioning is enabled)
  • Remove incomplete multipart uploads

Example lifecycle rule (JSON):

{
  "Rules": [
    {
      "ID": "MoveToGlacierAfter30Days",
      "Status": "Enabled",
      "Filter": {
        "Prefix": "backups/"
      },
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "GLACIER"
        }
      ],
      "Expiration": {
        "Days": 365
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

This rule moves any object under the backups/ prefix to Glacier after 30 days, and deletes it entirely after 365 days.

13. S3 Security

Security is one of the most important aspects of using S3 correctly. Misconfigured buckets are a common cause of real-world data breaches, so it's essential to understand S3's security model from day one.

Key security mechanisms:

  • Block Public Access — a bucket-level setting that prevents public access, even if a policy accidentally allows it
  • Bucket Policies — JSON documents that define who can access a bucket and what actions they can perform
  • IAM Policies — permissions attached to users, groups, or roles that control access to S3 resources
  • Access Control Lists (ACLs) — a legacy access-control mechanism (AWS now recommends using policies instead)

Graphic 4 — S3 Security

Image Prompt: A layered security diagram showing a "User" icon on the left, an arrow into an "IAM" shield icon, another arrow into an "S3 Bucket" icon, and a final arrow into an "Object" icon. Around the bucket, add small labeled badges: "IAM Permissions," "Bucket Policy," "Encryption," and "Block Public Access." Flat, professional vector style with a blue/orange security-themed palette, clean white background.

Caption: A layered view of how IAM, bucket policies, and encryption work together to secure S3 data.

Placement: At the start of this section, before the bullet list.

Example bucket policy that denies public access explicitly:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyPublicReadAccess",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-devto-s3-demo-bucket-2026/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

⚠️ Warning: Never attach a bucket policy that grants "Principal": "*" with "Effect": "Allow" on sensitive data unless you fully intend for that data to be publicly readable. This is one of the most common causes of accidental public data exposure on AWS.

14. S3 Encryption

S3 supports encryption both at rest and in transit.

Encryption in transit:

  • Enforced via HTTPS (TLS) when accessing S3 endpoints

Encryption at rest options:

Type Description
SSE-S3 S3-managed keys; encryption is automatic and free
SSE-KMS AWS Key Management Service–managed keys; adds auditability and control
SSE-C Customer-provided keys; you manage the encryption key yourself

Enable default encryption via CLI:

aws s3api put-bucket-encryption \
  --bucket my-devto-s3-demo-bucket-2026 \
  --server-side-encryption-configuration '{
    "Rules": [
      {
        "ApplyServerSideEncryptionByDefault": {
          "SSEAlgorithm": "AES256"
        }
      }
    ]
  }'
Enter fullscreen mode Exit fullscreen mode

💡 Tip: As a beginner, start with SSE-S3 (the default, no extra cost) before exploring SSE-KMS for more advanced key management needs.

15. S3 and IAM

IAM (Identity and Access Management) works hand-in-hand with S3 to control who can do what to your buckets and objects.

Instead of relying only on bucket policies, you can attach an IAM policy to a specific user or role, granting fine-grained permissions.

Example IAM policy allowing read-only access to one bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-devto-s3-demo-bucket-2026",
        "arn:aws:s3:::my-devto-s3-demo-bucket-2026/*"
      ]
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

Best practice: Follow the principle of least privilege — only grant the exact permissions a user or application needs, nothing more.

16. Static Website Hosting with S3

S3 can host a static website (HTML, CSS, JavaScript, and images) directly, without needing a traditional web server.

Steps to enable static website hosting:

  1. Open your bucket in the AWS Console
  2. Go to the Properties tab
  3. Scroll to Static website hosting and click Edit
  4. Enable hosting and specify an index document (e.g., index.html)
  5. Ensure the bucket allows public read access only if this is genuinely intended (static websites usually need to be public) 
[SCREENSHOT PLACEHOLDER: AWS S3 "Static website hosting" configuration panel]
Enter fullscreen mode Exit fullscreen mode

This screenshot should show the static website hosting settings, including fields for the index document and error document.

⚠️ Warning: Enabling public access for a static website is intentional and appropriate for that use case — but never apply the same public settings to buckets holding private or sensitive data.

17. Common S3 Use Cases

S3 is used across almost every type of application. Common examples include:

  • Backup and restore — storing backups of databases, servers, or applications
  • Static website hosting — hosting HTML/CSS/JS sites directly from a bucket
  • Data lakes and analytics — centralized storage for big data processing (e.g., with Amazon Athena or EMR)
  • Media storage and delivery — storing images, videos, and audio files, often paired with Amazon CloudFront
  • Application asset storage — storing files uploaded by users in web or mobile apps
  • Log storage — centralizing logs from AWS services like CloudTrail, ELB, or CloudFront
  • Disaster recovery — cross-region replication for business continuity

18. Practical Beginner S3 Project

Let's put everything together with a hands-on project: "Upload and Manage Files with Amazon S3."

Graphic 5 — Practical S3 Workflow

Image Prompt: A vertical step-by-step flowchart with six connected stages, each in a rounded rectangle: "Create Bucket" → "Upload Object" → "Configure Permissions" → "Enable Versioning" → "Configure Lifecycle" → "Access Object." Use simple arrows connecting each step, flat vector icons beside each label (bucket icon, upload icon, lock icon, clock icon, recycle icon, eye icon), consistent blue/orange color scheme, clean white background.

Caption: The end-to-end workflow we'll follow in this hands-on project.

Placement: At the top of this section, before Step 1.

Prerequisites

  • An AWS account (the AWS Free Tier is sufficient)
  • AWS CLI installed and configured (aws configure)
  • Basic familiarity with the terminal

Step 1: Create the Bucket 

aws s3 mb s3://my-first-s3-project-2026
Enter fullscreen mode Exit fullscreen mode

Step 2: Upload a File

Create a simple text file locally, then upload it:

echo "Hello from my first S3 project!" > hello.txt
aws s3 cp hello.txt s3://my-first-s3-project-2026/hello.txt
Enter fullscreen mode Exit fullscreen mode

Step 3: Check the Object 

aws s3 ls s3://my-first-s3-project-2026
Enter fullscreen mode Exit fullscreen mode

You should see hello.txt listed as an object in your bucket.

Step 4: Using the AWS CLI to Retrieve the File 

aws s3 cp s3://my-first-s3-project-2026/hello.txt ./downloaded-hello.txt
Enter fullscreen mode Exit fullscreen mode

Step 5: Enable Versioning 

aws s3api put-bucket-versioning \
  --bucket my-first-s3-project-2026 \
  --versioning-configuration Status=Enabled
Enter fullscreen mode Exit fullscreen mode

Now, try uploading a modified version of hello.txt and notice that S3 keeps both versions instead of overwriting the original.

Step 6: Configure a Lifecycle Rule

Create a file named lifecycle.json:

{
  "Rules": [
    {
      "ID": "DeleteOldVersions",
      "Status": "Enabled",
      "Filter": {},
      "NoncurrentVersionExpiration": {
        "NoncurrentDays": 30
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

Apply it:

aws s3api put-bucket-lifecycle-configuration \
  --bucket my-first-s3-project-2026 \
  --lifecycle-configuration file://lifecycle.json
Enter fullscreen mode Exit fullscreen mode

This rule automatically deletes non-current (old) object versions after 30 days.

Step 7: Basic Security Considerations

  • Confirm Block Public Access is still enabled (it is, by default)
  • Avoid attaching any policy with "Principal": "*" unless you specifically intend for the content to be public
  • Consider enabling default encryption, as shown in Section 14

Step 8: Cleanup — Delete Resources When Finished

To avoid unnecessary charges, clean up your test resources:

# Delete the object
aws s3 rm s3://my-first-s3-project-2026/hello.txt

# Remove all objects and versions, then delete the bucket
aws s3 rb s3://my-first-s3-project-2026 --force
Enter fullscreen mode Exit fullscreen mode

⚠️ Warning: aws s3 rb --force permanently deletes the bucket and all objects/versions inside it. Double-check the bucket name before running this command.

19. Important S3 Concepts to Remember

  • S3 stores objects, not traditional files, inside buckets
  • Bucket names must be globally unique
  • S3 has no real folders — it simulates them using key prefixes
  • Choose the right storage class based on access frequency
  • Versioning protects against accidental overwrites/deletions
  • Lifecycle rules automate cost optimization
  • Always keep Block Public Access enabled unless hosting a public static website
  • Use IAM policies and bucket policies together, following least privilege
  • Enable encryption for data at rest whenever possible

20. Conclusion

Amazon S3 is a foundational AWS service that you'll encounter in almost every cloud, DevOps, or backend engineering role. By understanding buckets, objects, keys, storage classes, versioning, lifecycle rules, and security fundamentals, you now have a solid, practical foundation to build on.

The best way to reinforce this knowledge is to keep practicing: create a few test buckets, experiment with the CLI, try enabling versioning and lifecycle rules, and always remember to clean up your resources afterward to avoid unnecessary costs.

Key Takeaways

  • Amazon S3 is a scalable, durable, and cost-effective object storage service
  • Data is organized into buckets and objects, identified by unique keys
  • Security should always be a priority — use IAM, bucket policies, and encryption together
  • Storage classes and lifecycle rules help you control costs as your usage grows
  • Hands-on practice is the fastest way to build real S3 confidence

Let's Connect!

If you found this guide helpful, I'd love to hear about your own AWS learning journey. What was the first AWS service you learned, and what tripped you up the most when you were starting out? Share your experience in the comments below — let's learn together! 🚀

Tags: #aws #cloud #devops #tutorial

Top comments (0)