S3 shows up in more SAA-C03 questions than any other single service. Most of them come down to choosing a storage class or writing a lifecycle rule, so that is where to spend your attention.
The model
S3 stores objects (up to 5 TB each) in buckets. Bucket names are globally unique across all of AWS, though the bucket itself lives in one Region. There is no real directory structure — prefixes in the key just look like folders.
Durability is 99.999999999% (eleven nines) across every storage class, achieved by replicating across at least three Availability Zones — with the deliberate exception of One Zone-IA. Availability varies by class.
Writes are strongly consistent: after a successful PUT, a subsequent GET returns the new data. This has been true since December 2020, and older material claiming eventual consistency is out of date.
Storage classes
| Class | Retrieval | Min. duration | Use for |
|---|---|---|---|
| Standard | Milliseconds | None | Frequently accessed data. The default. |
| Intelligent-Tiering | Milliseconds | None | Unknown or changing access patterns. Moves objects automatically; small monitoring fee, no retrieval charges between the main tiers. |
| Standard-IA | Milliseconds | 30 days | Infrequent access needing immediate availability. Cheaper storage, charged per GB retrieved. |
| One Zone-IA | Milliseconds | 30 days | Infrequent access to reproducible data. ~20% cheaper than Standard-IA, single AZ. |
| Glacier Instant Retrieval | Milliseconds | 90 days | Archives needing instant access — medical images, news media. |
| Glacier Flexible Retrieval | Minutes to hours | 90 days | Archives where a wait is acceptable. Expedited 1–5 min, Standard 3–5 hr, Bulk 5–12 hr. |
| Glacier Deep Archive | 12–48 hours | 180 days | The cheapest storage in AWS. Long-term compliance retention. |
The retrieval-time tolerance in the question is the answer. "Within milliseconds" → Standard, IA or Glacier Instant Retrieval. "Within minutes" → Glacier Flexible Retrieval (expedited). "Within hours" → Glacier Flexible Retrieval (standard/bulk). "Within 12–48 hours" or "rarely if ever accessed" → Deep Archive. Read that phrase first and most of the option list disqualifies itself.
Delete an object from Standard-IA after 10 days and you are still billed for 30. From Deep Archive after a month, and you are billed for 180 days. This is why "move everything to Glacier immediately" is often the wrong answer for data with a short life — the minimum-duration charge exceeds the saving.
Lifecycle configurations
Lifecycle rules automate transitions and expirations by prefix, tag or object size:
- Transition actions move objects to a colder class after N days.
- Expiration actions delete objects after N days.
- Rules can target non-current versions separately — keep the current version in Standard while old versions go to Glacier after 30 days and are deleted after a year.
- Incomplete multipart uploads should be expired after 7 days. Abandoned parts are invisible in the console but fully billed, and cleaning them up is a standard cost-optimisation answer.
Transitions flow one way — from hot to cold. Restoring from Glacier is a retrieval, not a lifecycle transition.
Versioning
With versioning enabled, every overwrite creates a new version and every delete places a delete marker rather than destroying data. Once enabled it can only be suspended, never disabled. Combined with MFA Delete, it becomes a strong defence against accidental and malicious deletion — and it is a prerequisite for replication.
Replication
- Cross-Region Replication (CRR) — disaster recovery, latency reduction, compliance with data-residency rules.
- Same-Region Replication (SRR) — log aggregation, production-to-test copies, account separation.
Requirements: versioning on both buckets, and an IAM role for S3 to assume. Replication is asynchronous and, by default, applies only to objects created after it is enabled — S3 Batch Replication backfills existing objects. Replication Time Control (RTC) adds a 15-minute SLA. Replication is not transitive: A→B and B→C does not give A→C.
Security
- Block Public Access — on by default at the account and bucket level. Leave it on. When a scenario describes accidental public exposure, enabling this is the fix.
- Bucket policies — resource-based, the main tool for cross-account access and for conditions such as requiring TLS (
aws:SecureTransport) or a specific encryption key. - Encryption — SSE-S3 by default on all new buckets; SSE-KMS when key control and auditing are needed.
- Presigned URLs — time-limited access to a private object without changing any policy. The answer for "let a user download this one file for the next hour".
- Access Points — named endpoints with their own policies, simplifying access management on shared buckets. Object Lambda Access Points transform data as it is retrieved, for example redacting PII per requester.
Object Lock
Write-once-read-many retention for compliance:
- Governance mode — users with
s3:BypassGovernanceRetentioncan override. - Compliance mode — nobody can override, including the root user, until retention expires.
- Legal hold — indefinite protection, independent of any retention period.
If a question says logs must be immutable "even to administrators", it is compliance mode.
Performance
- S3 scales to at least 3,500 PUT/COPY/POST/DELETE and 5,500 GET/HEAD requests per second per prefix. Spreading keys across prefixes multiplies that.
- Multipart upload is recommended above 100 MB and required above 5 GB — it also parallelises and allows retrying a single failed part.
- Byte-range fetches parallelise downloads.
- Transfer Acceleration uses CloudFront edge locations to speed long-distance uploads.
- S3 Select retrieves a subset of an object using SQL, cutting the data transferred for large CSV, JSON and Parquet files.