Amazon S3 in forty-two slides: the bucket name and address, objects, tags, sizes and limits, durability and consistency, multipart upload, S3 Transfer Acceleration, pricing, the storage classes and lifecycle rules, versioning, Object Lock and replication, and S3 security: resource-based policies and the bucket policy, how they combine with identity policies, conditions, Block Public Access, access points, presigned URLs and encryption; then static websites and event notifications.
The slides
The tool is forty-two slides in five sections, after an introduction:
- Introduction: object storage beside block and file storage.
- 1. Buckets and objects: the bucket name as an ID, reaching a bucket over HTTPS, the object, tags on S3 and on every AWS resource, durability and consistency, object sizes and S3's limits, large uploads, S3 Transfer Acceleration on a world map, and using it (with an exam question), what S3 charges for.
- 2. Storage classes: the classes side by side, the storage behind them (hard drives, shards, online or not),
the path of a request inside S3, Intelligent-Tiering, restoring from Glacier, lifecycle rules,
choosing a class, and five exam questions on lifecycle rules and Intelligent-Tiering.
- 3. Versioning and protection: versioning (every version stored whole), the delete marker, MFA delete and Object
Lock, replication, five exam questions (compliance and governance mode, legal hold, SEC 17a-4), and five
troubleshooting questions (versions gone, replication, backups to another account, hidden bytes).
- 4. Security: the section that adds to IAM.
- Who can access a bucket: the five mechanisms in one table, before the details.
- IAM identity policy vs. resource policy: a policy on the resource, with a
Principal; the bucket policy is S3's. - Bucket policy: one statement, then the bucket or its objects as
Resource; how it combines with identity
policies, in one account and across two; its conditions. - ACLs (legacy) and Block Public Access, access points, presigned URL, encryption.
- AWS KMS: why the key never leaves it; envelope encryption, as S3 does it for SSE-KMS.
- Client-side encryption: what the CLI cannot do, and the tools that can; and five exam questions on encryption.
- Identity policy or bucket policy: the exam's question.
- 5. Websites and events: static website hosting and event notifications.
The buttons on the left and right edges move between slides. So do the arrow keys and a swipe.
The IAM it builds on is in
IAM: Identities, Policies and Roles.
Sources
We checked the figures on the slides against AWS's documentation on 2026-11-13.