Amazon S3
Object storage that scales without a server — the default home for files, backups, static sites, data lakes, and build artifacts across nearly every cloud role.
Storage · AWS
What it is
Amazon S3 (Simple Storage Service) is object storage — not a filesystem, not a database. You put files (called objects) into containers (called buckets), and S3 handles storage, retrieval, and durability automatically, at any scale, with no server to manage.
Because there is no server sitting idle between requests, you pay only for what you store and transfer. That combination — no capacity to plan, no machine to patch, no idle cost — is why S3 is the usual answer to "where do these files go?"
Core concepts
- Bucket — a globally-named container for objects. Region-scoped, and private the moment it exists.
- Object — a file plus its metadata (size, content type, last-modified), retrieved by key.
- Static website hosting — a bucket can serve its objects directly over HTTP, with a designated index and error document.
- Access control — everything is private until a policy says otherwise, and public access is blocked at both the account and bucket level by default. Opening it is a deliberate act, which is the point.
Properties CloudSynth teachesderived from synthesized templates
These are the CloudFormation properties you actually configure in the lessons — read out of the template the reference solution synthesizes, so this list can't drift from what's taught.
| Resource | Property | Taught in |
|---|---|---|
| AWS::S3::Bucket | PublicAccessBlockConfiguration | s3-03-public-read-access, s3-04-bucket-deployment, single-page-app-02-host-the-app, single-page-app-03-fix-the-integration, single-page-app-04-grant-the-permission |
| AWS::S3::Bucket | VersioningConfiguration | cdk-onboarding-05-first-stack |
| AWS::S3::Bucket | WebsiteConfiguration | s3-02-static-hosting, s3-03-public-read-access, s3-04-bucket-deployment, single-page-app-02-host-the-app, single-page-app-03-fix-the-integration, single-page-app-04-grant-the-permission |
| AWS::S3::BucketPolicy | Bucket | s3-03-public-read-access, s3-04-bucket-deployment, single-page-app-02-host-the-app, single-page-app-03-fix-the-integration, single-page-app-04-grant-the-permission |
| AWS::S3::BucketPolicy | PolicyDocument | s3-03-public-read-access, s3-04-bucket-deployment, single-page-app-02-host-the-app, single-page-app-03-fix-the-integration, single-page-app-04-grant-the-permission |
Security & best practice
CloudSynth grades your infrastructure against the same cdk-nag rules real teams run in CI. These are the rules that actually fire on the lessons' templates:
AwsSolutions-APIG1The API does not have access logging enabled. Enabling access logs helps operators view who accessed an API and how the caller accessed the API.
AwsSolutions-APIG2The REST API does not have request validation enabled. The API should have basic request validation enabled. If the API is integrated with custom source (Lambda, ECS, etc..) in the backend, deeper input validation should be considered for implementation.
AwsSolutions-APIG3The REST API stage is not associated with AWS WAFv2 web ACL. AWS WAFv2 is a web application firewall that helps protect web applications and APIs from attacks by allowing configured rules to allow, block, or monitor (count) web requests based on customizable rules and conditions that are defined.
AwsSolutions-APIG4The API does not implement authorization. In most cases an API needs to have an authentication and authorization implementation strategy. This includes using such approaches as IAM, Cognito User Pools, Custom authorizer, etc.
AwsSolutions-APIG6The REST API Stage does not have CloudWatch logging enabled for all methods. Enabling CloudWatch logs at the stage level helps operators to track and analyze execution behavior at the API stage level.
AwsSolutions-COG4The API GW method does not use a Cognito user pool authorizer. API Gateway validates the tokens from a successful user pool authentication, and uses them to grant your users access to resources including Lambda functions, or your own API.
AwsSolutions-DDB3The DynamoDB table does not have Point-in-time Recovery enabled. DynamoDB continuous backups represent an additional layer of insurance against accidental loss of data on top of on-demand backups. The DynamoDB service can back up the data with per-second granularity and restore it to any single second from the time PITR was enabled up to the prior 35 days.
AwsSolutions-L1The non-container Lambda function is not configured to use the latest runtime version. Use the latest available runtime for the targeted language to avoid technical debt. Runtimes specific to a language or framework version are deprecated when the version reaches end of life. This rule only applies to non-container Lambda functions.
AwsSolutions-S1The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket.
AwsSolutions-S10The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.
AwsSolutions-S2The S3 Bucket does not have public access restricted and blocked. The bucket should have public access restricted and blocked to prevent unauthorized access.
AwsSolutions-S5The S3 static website bucket either has an open world bucket policy or does not use a CloudFront Origin Access Identity (OAI) in the bucket policy for limited getObject and/or putObject permissions. An OAI allows you to provide access to content in your S3 static website bucket through CloudFront URLs without enabling public access through an open bucket policy, disabling S3 Block Public Access settings, and/or through object ACLs.
For your role
Developer
Host a static frontend, store user uploads, and serve assets — often behind a CDN. `getObject` and `putObject` are your daily interface, and presigned URLs let a browser upload directly without the bytes passing through your API.
DevOps / Platform
Artifact and state buckets, lifecycle rules that expire old objects before they cost real money, versioning for recoverability, and access logging for audit. An S3 bucket policy is frequently the first place a least-privilege review starts.
ML Engineer
The default data lake. Training datasets, feature stores, and model artifacts live here and are read directly by training jobs and batch inference, which is why bucket layout and object-key conventions end up being a data-engineering decision rather than a storage one.
Solutions Architect
Relevant to this role — role note not yet written.
Combines with
Build it, graded
Reading is half of it. Everything above you can go build in the browser — your CDK code synthesized and graded against these exact properties.