Rahimah Sulayman

Posted on Oct 20

Getting Started with AWS S3: Creating a Bucket, Uploading an Object, and Understanding Why the Object URL Says Access Denied

#aws #s3 #cloud #beginners

Introduction

I'm starting a new series on AWS, and this first article covers Amazon S3 (Simple Storage Service), one of the most widely used services on AWS. I did this lab in my own personal AWS free-tier account, and I'll explain every term as it comes up.

By the end, you'll know how to:

Create an S3 bucket with a consistent naming convention
Read the bucket's ARN and properties
Upload a file to the bucket
Find an object's URL, and understand why opening the image works while opening the Object URL doesn't

What is Amazon S3?

Amazon S3 is an object storage service. Instead of organizing data in a traditional disk with a file system, S3 stores data as objects inside buckets. You can store and retrieve any amount of data from anywhere, and you pay only for what you use.

Three terms to know first:

Bucket: a container for your data. Every object in S3 lives inside a bucket.
Object: the thing you store. It's the file itself plus its metadata (size, type, last modified date and so on).
Key: the object's unique name inside the bucket. For my file, the key is datacenter.png.

Step 1: Open the S3 service

In the AWS Management Console, I typed S3 into the search bar and selected S3 (Scalable Storage in the Cloud) from the results.

This opens the Amazon S3 landing page, where Create bucket is the first thing you see.

Step 2: Create a bucket

I clicked Create bucket, and the only thing I had to provide was the bucket name. The region was already set for me (more on that below), and I left everything else at the defaults to keep things simple.

Region

I didn't pick the region on this page. The Create bucket page shows it as plain text, not a dropdown: Europe (Stockholm) eu-north-1. That's because S3 creates a bucket in whichever region your console is currently set to, and mine was already set to Stockholm. If you want a different region, switch it with the region selector in the top bar of the console before you click Create bucket.

A region is a physical geographic location where AWS runs data centers. Your bucket's data stays in the region it was created in, and the region affects latency (how close the data is to your users) and pricing.

Bucket type

I kept General purpose, which AWS recommends for most use cases. The other option, Directory, is for low-latency workloads that use a single Availability Zone.

Bucket namespace

I kept Global namespace. A namespace is the set of names in which yours has to be unique. In the global namespace, a bucket name must be unique across all AWS accounts, in every region. If someone else already has my-bucket, you can't use it. The console also offers an Account Regional namespace (labelled "recommended"). Buckets created there are unique only within your own account, so no other AWS account can ever claim the same name. I stayed with the global namespace for this lab.

Bucket name and the prefix naming convention

I named my bucket aws-lab1-rahimah.

The aws-lab1- part is a prefix I chose as a naming convention. A consistent prefix gives you three things:

It keeps names unique, since adding your own name or project helps avoid clashes in the global namespace.
It groups related resources together (aws-lab1-..., aws-lab2-...).
It makes resources easy to find and to clean up later.

S3 bucket names must be 3 to 63 characters long, can contain only lowercase letters, numbers, periods and hyphens, and must begin and end with a letter or number.

Default encryption

Further down the page, Default encryption was already set to Server-side encryption with Amazon S3 managed keys (SSE-S3). This means S3 automatically encrypts every new object at rest, using keys that AWS manages for you. You don't have to do anything. I left it as it was and clicked Create bucket.

S3 confirmed with a green banner: Successfully created bucket "aws-lab1-rahimah". The Objects tab shows Objects (0) because the bucket is empty.

Step 3: Look at the bucket's properties and ARN

I opened the Properties tab. The Bucket overview shows three things:

AWS Region: Europe (Stockholm) eu-north-1
Creation date: October 20, 2026
Amazon Resource Name (ARN): arn:aws:s3:::aws-lab1-rahimah

What is an ARN?

An Amazon Resource Name (ARN) is the unique identifier AWS gives every resource. It's how you point at a specific resource in IAM policies, logs and other services. The general shape is:

arn:partition:service:region:account-id:resource

For S3 buckets, the region and account sections are empty, which is why you see three colons in a row (:::). The bucket name is the final part.

The Properties tab also shows two settings that were off by default:

Bucket Versioning: Disabled. Versioning keeps multiple versions of an object, so you can recover from accidental overwrites or deletions. With it disabled, uploading a file with the same key replaces the old one.
Multi-factor authentication (MFA) delete: Disabled. This extra layer of security requires MFA before you can permanently delete object versions.

Step 4: Upload a file to the bucket

Back on the Objects tab, I clicked Upload.

On the Upload page, I clicked Add files and picked an image called datacenter.png from my Downloads folder. You can also drag and drop files, or use Add folder to upload a whole folder.

The page then listed the file as 1 total, 2.4 MB, type image/png, with the destination shown as s3://aws-lab1-rahimah.

Scrolling down, you'll see two collapsed sections:

Permissions: where you can grant public access and access to other AWS accounts.
Properties: where you can set the storage class, encryption settings and tags.

I left both alone and clicked Upload.

The next page showed Upload succeeded, with a summary of 1 file, 2.4 MB, 100% succeeded and 0 failed.

Back in the bucket, Objects (1) now lists datacenter.png, size 2.4 MB, and storage class Standard.

Storage class controls how your data is stored and what it costs. Standard is the default and is meant for frequently accessed data. Other classes, such as Glacier, are cheaper for data you rarely need to retrieve.

Step 5: Explore the object's details

I clicked datacenter.png to open its details. The Object overview shows:

Owner: the canonical ID of the AWS account that owns the object
AWS Region: eu-north-1
Last modified, Size and Type
Key: datacenter.png
S3 URI: s3://aws-lab1-rahimah/datacenter.png
ARN: arn:aws:s3:::aws-lab1-rahimah/datacenter.png
Entity tag (ETag): an identifier for this specific version of the object's content
Object URL: https://aws-lab1-rahimah.s3.eu-north-1.amazonaws.com/datacenter.png

Two of these are easy to confuse:

The S3 URI (s3://bucket/key) is what AWS tools like the AWS CLI and SDKs use to refer to an object.
The Object URL is the HTTPS address of the object on the internet, in the form https://bucket-name.s3.region.amazonaws.com/key.

The ARN here is the bucket's ARN with the object key added on the end.

Step 6: Open the image vs. use the Object URL

This is the part that surprised me, and it taught me the most. There are two ways to view the uploaded image, and they behave differently.

Option 1: Click "Open"

Clicking the Open button displays the image in a new browser tab. The address bar shows a very long URL that carries extra parameters such as X-Amz-Algorithm=AWS4-HMAC-SHA256.

That is a presigned URL. When you click Open, the console uses your own credentials to generate a temporary, signed link that grants access to the object for a short time. S3 sees the signature, confirms that a permitted user created it, and serves the file.

Option 2: Paste the Object URL

When I copied the plain Object URL into the browser, I got this:

<Error>
  <Code>AccessDenied</Code>
  <Message>Access Denied</Message>
  ...
</Error>

Why the difference?

The Object URL is an unauthenticated request. When you paste it into a browser, there's no signature and nothing that tells S3 who you are, so S3 treats you as an anonymous visitor. S3 buckets and objects are private by default, and only the owner can access them unless permissions are explicitly granted. So the anonymous request is refused with AccessDenied.

The error is not a bug. It shows S3's security model working as designed: nothing is public until you deliberately make it so.

Making objects public

If you need public access, for example to host images on a website, you'd have to change two things: turn off the relevant Block Public Access settings on the bucket, and then grant read access through a bucket policy or object permissions. Only do this for data that's genuinely meant to be public. For private files, presigned URLs are a safer way to share something temporarily.

Key Takeaways

A bucket is a container and an object is a file inside it, identified by its key.
Bucket names must be globally unique, so a naming prefix like aws-lab1- helps keep names unique and organized.
The region determines where your data physically lives.
An ARN uniquely identifies any AWS resource, and an object's ARN is its bucket's ARN plus the key.
The S3 URI is for AWS tools, while the Object URL is the HTTPS address.
S3 is private by default. Opening an object from the console works because it uses a presigned URL, while the plain Object URL returns AccessDenied.

Clean up

To avoid unexpected charges, delete what you created. You must empty a bucket before you can delete it:

Select datacenter.png and click Delete. Make sure you tick it, so that the Delete button is not greyed out.

Then confirm deletion.

Go back to the bucket list, select aws-lab1-rahimah and click Delete.

Conclusion

In this first lab, I created an S3 bucket, uploaded an object, and learned why access to it is blocked by default. Next in the series, I'll build on this with more S3 features and other AWS services.

If you're learning AWS, let me know in the comments which service I should cover next.