AWS S3
Also known as: Amazon Simple Storage Service
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is AWS S3?
Amazon S3 is AWS object storage for durable files, backups, data lakes, logs and application assets. This profile connects the concept to KBY's practical engineering guidance.
S3 stores objects inside buckets and controls them through API requests, IAM and bucket policies. Versioning, lifecycle rules, encryption, replication and Block Public Access support governance, while consistency and object semantics differ from a traditional filesystem.
Store and retrieve durable object data at cloud scale.
- Data lakes and big data analytics
- Backup and restore
- Static website hosting
Explore related technologies
Parent technology
4 resources for AWS S3
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with AWS S3
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Config Traps(4)
Recognise and avoid known failure modes.
- S3 StringLike Conditions: The Wildcard Principal EscapeA bucket policy grants Principal "*" and relies on a StringLike condition against aws:PrincipalArn to narrow access, but the glob pattern matches any account number in that ARN segment, and IAM Access Analyzer excludes the bucket from its public findings once that condition key appears, so no scanner in the account ever flags the exposure. Open
- S3 PutBucketPolicy Ignores Block Public Access StateA wildcard bucket policy can be written and saved successfully in S3 even while every Block Public Access flag is enabled, because the API validates syntax, not exposure. The bucket sits dormant until someone flips the account-level BPA setting, and objects go public with no new policy event in CloudTrail to catch. Open
- S3 Bucket Policies: The Missing SourceAccount CheckA bucket policy grants a wildcard AWS service Principal like sns.amazonaws.com or cloudtrail.amazonaws.com write access without pinning aws:SourceAccount, so any AWS account can configure that same service to target the bucket. IAM boundaries never trigger, because the request arrives as a trusted first-party service call, not a cross-account API invocation. Open
- S3 Wildcard Principal Without Conditions: The LeakDeleting a Condition block to silence an AccessDenied error leaves Principal "*" unconstrained, so s3:GetObject or s3:PutObject becomes callable by any unauthenticated caller. Buckets with BlockPublicPolicy overridden to false accept the policy silently, and scanners fingerprint the exposure within hours. Open