What you'll learn
- S3 is built for 99.999999999% durability, but durability doesn't protect you from your own deletes or a Regional outage — versioning, replication and Object Lock do.
- Observe object-level activity with CloudTrail data events and request metrics; see the whole estate with Storage Lens.
- Most S3 bills are driven by storage class choice, request counts and data transfer out — all of which you can see and tune.
Section 01
Throughput
- Plan on at least 3,500 writes and 5,500 reads per second per prefix, and spread very hot traffic over several prefixes.
- Expect occasional
503 SlowDownwhile S3 scales; keep the SDK's retries on. - Use byte-range GETs and multipart uploads in parallel for large objects; put CloudFront in front of popular sprites.
- For single-digit-millisecond access to hot data in one Availability Zone, S3 Express One Zone uses a separate directory bucket type.
Section 02
Recovery
| Risk | Control |
|---|---|
| Someone deletes or overwrites a card | Versioning, plus conditional writes (Quest 6) |
| A Region becomes unavailable | Cross-Region Replication (needs versioning on both buckets); Replication Time Control for a 15-minute objective |
| Ransomware or a rogue admin deletes versions | Object Lock in compliance mode — WORM retention nobody can shorten |
| You need point-in-time copies | AWS Backup for S3 |
Section 03
Monitoring
- CloudTrail data events record who read, wrote or deleted which object. Bucket-level calls are logged by default; object-level ones aren't until you enable them.
- CloudWatch request metrics show 4xx/5xx rates and latency per bucket or prefix.
- S3 Storage Lens summarises usage and activity across accounts, and flags buckets without versioning or with incomplete multipart uploads.
- IAM Access Analyzer for S3 lists buckets shared outside your account.
Section 04
Cost
Storage is billed per GB-month and class; requests per thousand; and data transfer out to the internet per GB. Reads through CloudFront are usually cheaper than direct. Storage Class Analysis and Storage Lens show which prefixes would save money in another class.
And if a tool insists on a file system, S3 Files (launched April 2026) can present a bucket as one — the objects underneath are the same ones your code writes with the SDK.
Check
Check your understanding
Quick Quiz · one question, as many tries as you need.
Regulations require tournament results to be kept unaltered for 5 years, even from administrators. Which feature meets that?
Choose one answer.