Aws S3

---
name: aws-s3
description: "Amazon S3 cloud object storage service administration and design: storage classes, lifecycle policies, replication (CRR/SRR/RTC), versioning, Object Lock, encryption, access points, S3 Express One Zone, S3 Tables, Transfer Acceleration, and cost optimization. Use for \"S3\", \"AWS S3\", \"S3 bucket\", \"S3 lifecycle\", \"S3 Glacier\", \"S3 replication\", \"CRR\", \"SRR\", \"S3 Express\", \"S3 storage class\", \"S3 versioning\", \"Object Lock\", \"S3 Transfer Acceleration\", \"S3 access point\", \"MRAP\", \"S3 Select\", \"S3 Tables\", \"S3 Intelligent-Tiering\", \"S3 Storage Lens\", \"S3 Batch Operations\". Do NOT use for general AWS account/VPC/multi-service architecture — that's the `cloud-platforms` plugin."
license: MIT
---

# AWS S3

This skill covers Amazon S3 cloud object storage, including:

- Storage classes (Standard, Express One Zone, IA, One Zone-IA, Intelligent-Tiering, Glacier variants, Deep Archive)
- Lifecycle policies, transition waterfall, and noncurrent version management
- Replication (CRR, SRR, S3 RTC, Batch Replication, bi-directional)
- Versioning, Object Lock (WORM), MFA Delete, and legal hold
- Encryption (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C) and key management
- Access Points, Multi-Region Access Points (MRAP), and VPC endpoints
- S3 Express One Zone (directory buckets) for low-latency workloads
- S3 Tables (Apache Iceberg), S3 Select, S3 Object Lambda
- S3 Batch Operations, S3 Inventory, S3 Storage Lens
- Event notifications (SQS, SNS, Lambda, EventBridge)
- Performance patterns: prefix design, multipart upload, byte-range fetch, Transfer Acceleration
- Security: Block Public Access, IAM policies, bucket policies, Macie, GuardDuty

For cross-platform storage comparisons, see the `overview` skill.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for access denied, slow transfers, replication lag, cost analysis, CloudWatch metrics
   - **Architecture / design** -- Load `references/architecture.md` for storage classes, versioning, lifecycle, replication, access points, Express One Zone
   - **Best practices** -- Load `references/best-practices.md` for security hardening, lifecycle design, cost optimization, performance patterns, encryption strategy

2. **Load context** -- Read the relevant reference file.

3. **Analyze** -- Consider storage class fit, access patterns, cost model, security requirements, compliance needs.

4. **Recommend** -- Provide actionable guidance with AWS CLI commands, IAM policies, and lifecycle configurations.

## Core Concepts

### Bucket / Object Model

- **Bucket**: Top-level container, globally unique name, exists in a single region
- **Object**: Data + metadata + key + version ID. No filesystem hierarchy -- `/` in keys simulates folders
- **Durability**: 99.999999999% (11 nines) across minimum 3 AZs (Standard)

### Storage Classes

| Class | Retrieval | Min Storage | Best For |
|---|---|---|---|
| Standard | Milliseconds | None | Frequently accessed |
| Express One Zone | Single-digit ms | None | ML/AI, HPC (directory buckets) |
| Intelligent-Tiering | Varies | None | Unknown access patterns |
| Standard-IA | Milliseconds | 30 days | Infrequent, long-lived |
| One Zone-IA | Milliseconds | 30 days | Recreatable infrequent data |
| Glacier Instant | Milliseconds | 90 days | Quarterly archives |
| Glacier Flexible | Minutes-hours | 90 days | Annual archives |
| Glacier Deep Archive | 12-48 hours | 180 days | Regulatory, 7-10+ years |

### Lifecycle Transition Waterfall

```
Standard -> Standard-IA -> Intelligent-Tiering -> One Zone-IA
  -> Glacier Instant -> Glacier Flexible -> Glacier Deep Archive
```

Transitions are one-way within a lifecycle rule.

### Replication

| Type | Scope | Use Case |
|---|---|---|
| CRR | Cross-region | Geographic redundancy, compliance |
| SRR | Same-region | Log aggregation, env separation |
| S3 RTC | Either | SLA-backed 15-minute replication |
| Batch | Existing objects | Backfill, retry failures |
| Bi-directional | MRAP | Active-active multi-region |

### Key Security Features

- **Block Public Access** at account and bucket level
- **Object Ownership = Bucket Owner Enforced** (disables ACLs)
- **SSE-S3** default encryption (SSE-C disabled by default April 2026)
- **VPC Gateway Endpoints** for private S3 access (free)
- **GuardDuty S3 Protection** and **Amazon Macie** for threat/data discovery

## Reference Files

- `references/architecture.md` -- Storage classes, versioning, lifecycle, replication, event notifications, access points, Express One Zone, S3 Select, Object Lambda, Object Lock
- `references/best-practices.md` -- Security hardening (10-point checklist), lifecycle design, cost optimization, performance patterns, encryption strategy, monitoring
- `references/diagnostics.md` -- Access denied troubleshooting, slow transfer diagnosis, replication lag, cost analysis, CloudWatch metrics, Storage Lens, diagnostic toolkit

## Diagnostic Scripts

Ready-made AWS CLI v2 audit scripts (read-only IAM) in `scripts/`, numbered by investigation order.

- `scripts/01-bucket-governance-audit.sh` -- Region, versioning, encryption, public-access-block per bucket
- `scripts/02-lifecycle-versioning-audit.sh` -- Versioned buckets without noncurrent expiration (cost bombs)
- `scripts/03-bucket-size-metrics.sh` -- Size/object counts from CloudWatch without listing objects