Amazon S3

What is Amazon S3?

Amazon S3 (Simple Storage Service) is AWS’s object storage service and one of the oldest and most widely used cloud services in existence. Unlike a traditional hard drive or network drive, S3 does not store data in a directory hierarchy, but as individual objects in flat containers known as buckets. Each object can be accessed via a unique URL.

S3 is designed for a durability of 99.999999999% (“eleven nines”): data is automatically distributed redundantly across multiple data centres. This makes the service suitable for both non-critical files and business-critical backups.

Typical use cases

• Static website assets: Images, videos and documents are delivered from S3 – often in combination with the Amazon CloudFront CDN.
• Backups and archiving: Database dumps and file backups are stored cost-effectively and long-term in S3.
• Data lake: Raw data for analytics and machine learning is collected centrally in S3.
• Application uploads: Files uploaded by users are offloaded rather than stored on the application server.

Storage classes and cost optimisation

S3 offers various storage classes that differ in price and access speed. Choosing the right one significantly reduces storage costs:

• S3 Standard: For frequently used data requiring immediate access.
• S3 Intelligent Tiering: Automatically moves objects to cheaper classes based on access patterns – without manual intervention.
• S3 Glacier: Very cost-effective for long-term archives where retrieval times ranging from minutes to hours are acceptable.

Lifecycle rules can be used to automatically move objects to cheaper classes or delete them after a defined period of time.

Security and access control

S3 buckets are private by default. A common – and potentially serious – configuration error is accidentally making a bucket publicly accessible. AWS offers several layers of protection against this:

• Block Public Access: Prevents all public access at bucket or account level.
• Bucket Policies and IAM: Define in fine detail who is permitted to read or write which objects.
• Encryption: Data is encrypted on the server side, optionally using your own keys via AWS KMS.

S3 and data protection

For GDPR-compliant setups, store S3 data in an EU region. Combined with encryption via AWS KMS and a robust permissions framework, S3 can also be used for personal data in a legally compliant manner.

S3 for SMEs

S3 is relevant for almost every cloud project. Even the first step – offloading file uploads and backups – takes the strain off existing servers and reduces the risk of data loss. It is important to have a well-thought-out permissions and encryption strategy from the outset, so that sensitive data is not accidentally exposed.