AWS S3 Deep Dive Cheat Sheet
Comprehensive reference for S3 bucket operations, storage classes, lifecycle rules, and access control via CLI and policies.
2 PagesIntermediateFeb 10, 2026
CLI Basics
Core bucket and object operations.
bash
aws s3 mb s3://my-unique-bucket-name # Create bucketaws s3 ls # List bucketsaws s3 ls s3://my-unique-bucket-name/ # List objectsaws s3 cp file.txt s3://my-bucket/file.txt # Uploadaws s3 cp s3://my-bucket/file.txt ./ # Downloadaws s3 sync ./local-dir s3://my-bucket/prefix # Sync directoryaws s3 rm s3://my-bucket/file.txt # Delete objectaws s3 rb s3://my-bucket --force # Delete bucket + contents
Bucket Policy (JSON)
Grant public read access to a specific prefix.
json
{ "Version": "2012-10-17", "Statement": [ { "Sid": "PublicReadGetObject", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/public/*" } ]}
Lifecycle Rule (CLI)
Transition and expire objects automatically.
bash
aws s3api put-bucket-lifecycle-configuration \ --bucket my-bucket \ --lifecycle-configuration '{ "Rules": [{ "ID": "ArchiveOldObjects", "Status": "Enabled", "Filter": {"Prefix": "logs/"}, "Transitions": [{"Days": 30, "StorageClass": "GLACIER"}], "Expiration": {"Days": 365} }] }'
Storage Classes
Key storage classes to know.
- S3 Standard- Default, low-latency, frequently accessed data
- S3 Intelligent-Tiering- Auto-moves objects between tiers based on access patterns
- S3 Standard-IA- Infrequent access, lower storage cost, retrieval fee applies
- S3 One Zone-IA- Like Standard-IA but stored in a single AZ, cheaper, less durable
- S3 Glacier Instant Retrieval- Archive tier with millisecond retrieval
- S3 Glacier Deep Archive- Lowest cost, retrieval takes hours, for long-term archival
Key Features
Key key features to know.
- Versioning- Keeps multiple variants of an object to protect against overwrite/delete
- Presigned URL- Time-limited URL granting temporary access without IAM credentials
- Server-Side Encryption- SSE-S3, SSE-KMS, or SSE-C encrypt objects at rest
- Cross-Region Replication- Automatically copies objects to a bucket in another region
- Event Notifications- Trigger Lambda/SQS/SNS on object create/delete events
Multipart Upload (CLI)
Upload large objects in parallel parts and assemble them server-side.
bash
# InitiateUPLOAD_ID=$(aws s3api create-multipart-upload \ --bucket my-bucket --key big-file.bin \ --query 'UploadId' --output text)# Upload each part (repeat with --part-number 2, 3, ...)aws s3api upload-part --bucket my-bucket --key big-file.bin \ --part-number 1 --upload-id $UPLOAD_ID \ --body part1.bin# List uploaded parts to build the completion manifestaws s3api list-parts --bucket my-bucket --key big-file.bin \ --upload-id $UPLOAD_ID# Complete (parts.json = {"Parts":[{"ETag":"...","PartNumber":1}, ...]})aws s3api complete-multipart-upload --bucket my-bucket \ --key big-file.bin --upload-id $UPLOAD_ID \ --multipart-upload file://parts.json# Abort stuck uploads to stop paying for orphaned partsaws s3api abort-multipart-upload --bucket my-bucket \ --key big-file.bin --upload-id $UPLOAD_ID
S3 Access via VPC Gateway Endpoint
Restrict bucket access to traffic originating from a specific VPC endpoint.
json
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyUnlessFromVpce", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*" ], "Condition": { "StringNotEquals": { "aws:SourceVpce": "vpce-0123456789abcdef0" } } } ]}
S3 Select — Query Objects In Place
Run SQL against a CSV/JSON/Parquet object without downloading the whole file.
bash
aws s3api select-object-content \ --bucket my-bucket \ --key data/events.csv \ --expression "SELECT s._1, s._3 FROM S3Object s WHERE s._3 > '100'" \ --expression-type SQL \ --input-serialization '{"CSV": {"FileHeaderInfo": "NONE"}, "CompressionType": "NONE"}' \ --output-serialization '{"CSV": {}}' \ output.csv
Object Lock: Retention & Legal Hold
Enforce WORM (write-once-read-many) compliance on objects, immune to root-account deletion.
bash
# Bucket must have Object Lock enabled at creation timeaws s3api create-bucket --bucket compliance-bucket \ --object-lock-enabled-for-bucket# Set a COMPLIANCE-mode retention (cannot be shortened or removed, even by root)aws s3api put-object-retention --bucket compliance-bucket \ --key contract.pdf \ --retention '{"Mode": "COMPLIANCE", "RetainUntilDate": "2027-01-01T00:00:00Z"}'# Apply an independent legal hold (blocks deletion until explicitly released)aws s3api put-object-legal-hold --bucket compliance-bucket \ --key contract.pdf \ --legal-hold '{"Status": "ON"}'
Advanced Concepts
Mechanisms beyond basic upload/download that show up in production designs.
- Multipart Threshold- AWS CLI auto-splits uploads/downloads above ~8MB; tune via `aws configure set default.s3.multipart_threshold`
- S3 Transfer Acceleration- Routes uploads through CloudFront edge locations over optimized paths for distant clients
- Requester Pays- Shifts data transfer/request costs from the bucket owner to whoever downloads the object
- ETag Caveat- ETag equals MD5 only for single-part uploads; multipart uploads produce a composite hash, not a true MD5
- Strong Read-After-Write Consistency- All S3 operations (PUTs, DELETEs, LISTs) have been strongly consistent since Dec 2020 — no more eventual-consistency workarounds needed
- S3 Batch Operations- Run a single action (copy, tag, restore, Lambda invoke) across billions of objects listed in a manifest
- Same-Region Replication (SRR)- Like CRR but within one region, used for log aggregation or account-to-account backup
Pro Tip
Enable S3 Intelligent-Tiering on buckets with unpredictable access patterns instead of manually writing lifecycle rules — it automatically moves objects between access tiers with no retrieval fees or operational overhead.
Was this cheat sheet helpful?
Explore Topics
#AWSS3DeepDive#AWSS3DeepDiveCheatSheet#CloudComputing#Intermediate#CLIBasics#BucketPolicyJSON#LifecycleRuleCLI#StorageClasses#OOP#CommandLine#CheatSheet#SkillVeris
