AWS Builder Center

Builder Center

Learning AWS in Public — Part 4: Amazon S3 Explained — Upload, Store, and Access Files in the Cloud

Learn how to use Amazon Simple Storage Service (Amazon S3) to store files in the cloud. This beginner-friendly, hands-on guide explains buckets, objects, storage classes, access permissions, and security. Follow along to create an S3 bucket, upload files, understand how to access stored objects, and explore how S3 integrates with backend applications. We'll also cover common mistakes, cost considerations, and best practices for managing cloud storage.

Series: AWS for Students — From Local Projects to the Cloud (4 articles)

  1. 1
    Learning AWS in Public: A Student Developer's Journey — Part 1
  2. …
  3. 4
    Learning AWS in Public — Part 4: Amazon S3 Explained — Upload, Store, and Access Files in the Cloud This article

Learning AWS in Public: A Student Developer's Journey — Part 4

Understanding Amazon S3: My First Step into Cloud Storage

In the previous article, we explored Amazon EC2 and learned how to deploy a basic web application on a virtual server.
We launched an instance, connected to it through SSH, installed the required software, and configured Nginx to serve our application over HTTP.
But there's another problem we encounter when building real-world applications.
Where should we store files uploaded by users?
Imagine building a student management system, an e-commerce platform, or a document assistant. These applications may need to store profile pictures, PDFs, reports, product images, and other files.
We could store these files directly on a server's filesystem. However, as an application grows, managing files alongside application servers can become difficult.
This is where Amazon S3 comes in.
In this article, we'll explore Amazon Simple Storage Service (Amazon S3), understand how object storage works, create a bucket, upload files, and learn how applications can use S3 to manage data.
Our goal is to understand the fundamentals before integrating cloud storage into a backend application.

1. What Is Amazon S3?

Amazon S3 is an object storage service provided by AWS. It allows us to store and retrieve data such as documents, images, videos, backups, and application files.
Instead of managing files directly on a server's disk, we can store them as objects in an S3 bucket.
For example, a web application might use S3 to store:
  • User profile images
  • PDF documents
  • Uploaded assignments
  • Product images
  • Application backups
  • Generated reports
  • Dataset files for machine learning
S3 is designed for high durability and scalable storage. However, it is important to understand that S3 is object storage, not a traditional relational database or a general-purpose server filesystem.
A simplified architecture looks like this:
1
2
3
4
5
6
7
8
9
10
11
12
Web Application
|
v
Backend API
|
v
Amazon S3
|
+----------+----------+
| | |
v v v
Images Documents Backups
The backend application can use AWS credentials and permissions to interact with S3 through its APIs or an AWS SDK.

2. Understanding Buckets and Objects

Before creating our first bucket, let's understand two important concepts.

What is a bucket?

A bucket is a container that stores objects in Amazon S3.
Think of it as a top-level storage location for a collection of files.
For example, an application might use a bucket named:
my-student-app-files
The actual bucket name must be globally unique within the applicable AWS partition, so this example may already be taken.

What is an object?

An object is the data stored in S3.
An object generally consists of:
  • The object's content
  • An object key
  • Metadata
  • Optional version information
For example:
1
2
3
4
5
6
Bucket: my-student-app-files

Objects:
profile-images/student-01.jpg
documents/assignment-01.pdf
reports/semester-report.pdf
The object key identifies an object within its bucket.
Notice that paths such as profile-images/student-01.jpg resemble filesystem directories. In S3, these are object keys, and the apparent folders are generally created by using prefixes in those keys.
This distinction becomes useful when organizing large collections of objects.

3. Why Use S3 Instead of Local File Storage?

Let's compare two approaches.
FeatureLocal server storageAmazon S3
Storage locationServer filesystemS3 bucket
Scaling storageMay require disk or server changesDesigned for scalable object storage
Application server replacementFiles may need to be copied or restoredObjects can remain in S3
Access managementFilesystem permissionsIAM and S3 access controls
IntegrationLocal filesystem APIsS3 API and SDKs
PricingServer and disk costsStorage, requests, transfer, and other applicable charges
Local storage is still useful for temporary files, application caches, and many development tasks.
However, S3 is often a good choice when an application needs durable object storage that can be accessed independently of individual application servers.
For example, if we replace an EC2 instance during deployment, files stored only on that instance may be lost when its storage is removed. Files stored in a separate S3 bucket can remain available independently of the instance.
S3 does not eliminate every storage-management responsibility, but it separates object storage from application compute.

4. Creating Your First S3 Bucket

Now let's create a bucket using the AWS Management Console.
Before proceeding, verify your account's current S3 pricing and free usage eligibility. Storage, requests, data transfer, and other features may incur charges.

Step 1: Open Amazon S3

Sign in to the AWS Management Console and search for S3.
Open the Amazon S3 service.

Step 2: Create a bucket

Choose Create bucket.
Provide a globally unique bucket name, such as:
shubham-learning-s3-demo
This is only an example. You must choose a name that is available.

Step 3: Select the AWS Region

Choose the Region where you want to create the bucket.
For a learning project, choose a Region that is convenient for your application and supports your intended services.
Remember that an S3 bucket's Region matters when designing an application and estimating data transfer or service costs.

Step 4: Configure security settings

For this beginner tutorial, keep Block Public Access enabled.
This prevents the bucket from becoming publicly accessible through common S3 public-access mechanisms.
Also, leave the default encryption settings enabled. Amazon S3 automatically encrypts new object uploads at rest by default using an S3-managed encryption option.
You can explore more advanced encryption configurations later.

Step 5: Create the bucket

Review your settings and choose Create bucket.
Your bucket should now appear in the S3 bucket list.
Congratulations! You've created your first S3 bucket.
At this point, we have a storage container, but we haven't uploaded anything yet.

5. Uploading Your First File

Let's upload a file to the bucket.
You can use a small text file, image, or PDF for this exercise. Avoid uploading sensitive personal information.

Step 1: Open the bucket

Select the bucket you just created.

Step 2: Choose Upload

Choose Upload, then select Add files.
Select a file from your computer.
For example, you could create a text file named hello-s3.txt containing:
1
Hello from my first Amazon S3 bucket!

Step 3: Upload the file

Review the upload options and choose Upload.
After the upload completes, you should see the object listed in the bucket.
Our storage structure now looks like this:
1
2
3
my-learning-bucket/
|
+-- hello-s3.txt
We have successfully stored an object in Amazon S3.
This is a small step, but the same basic operation is used to store much larger collections of files.

6. Understanding Object Keys

Let's make the bucket more organized.
Suppose we want to store different types of files for a student management application.
We might use these object keys:
1
2
3
4
profile-images/student-01.jpg
documents/assignment-01.pdf
documents/assignment-02.pdf
reports/semester-report.pdf
The prefixes help organize related objects.
However, they are not necessarily physical directories like those on a traditional filesystem.
For example, the object key:
documents/assignment-01.pdf
is a single key in the bucket.
This design makes it possible to organize objects using consistent naming conventions and retrieve groups of objects based on their prefixes.

7. Understanding S3 Access Permissions

One of the most important concepts when working with cloud storage is access control.
Uploading a file successfully does not mean that everyone can access it.
S3 access can depend on several controls, including:
  • IAM identity policies
  • S3 bucket policies
  • S3 Block Public Access settings
  • Object ownership and access-control settings
  • Other applicable organizational controls
For most beginner applications, the safest approach is to keep the bucket private and allow access through appropriately authorized application identities.
For example:
1
2
3
4
5
6
7
8
9
10
Application Backend
|
v
IAM Permissions
|
v
Private S3 Bucket
|
v
Authorized Objects
The backend can receive permission to upload or retrieve particular objects without making the entire bucket public.

Should you make your bucket public?

Generally, avoid making an entire bucket public just to display one image or download one file.
Public access should be enabled only when the application genuinely requires it and the implications are understood.
For private documents, invoices, student records, and other sensitive content, keep the bucket private and use a suitable authenticated access pattern.

8. Accessing an S3 Object

After uploading a file, you can select it in the S3 Console to inspect its properties.
The object details may include its key, size, modification time, and other metadata.
The console can also provide an object URL.
However, having an object URL does not automatically make the object publicly accessible.
If the bucket is private, an unauthenticated browser request will generally be denied.
For applications, there are several ways to access objects.

Option 1: AWS Console

Useful for manually inspecting files and performing administrative operations.

Option 2: AWS CLI

Useful for automating common S3 operations from a terminal.

Option 3: AWS SDK

Useful when a backend application needs to upload, retrieve, or manage objects programmatically.

Option 4: Presigned URLs

A presigned URL grants temporary access to a specific S3 operation, subject to the permissions and restrictions in effect.
This can be useful when a backend wants to let an authorized user upload or download a file without making the bucket public.
We'll explore this approach when integrating S3 with a backend API.

9. Exploring S3 with the AWS CLI

The AWS Command Line Interface lets us interact with S3 without relying entirely on the graphical console.
If you have the AWS CLI installed and configured with appropriate credentials, you can list buckets using:
1
aws s3 ls
To list objects in a specific bucket:
1
aws s3 ls s3://YOUR_BUCKET_NAME/
Replace YOUR_BUCKET_NAME with your actual bucket name.
To upload a file:
1
aws s3 cp hello-s3.txt s3://YOUR_BUCKET_NAME/
To download an object:
1
aws s3 cp s3://YOUR_BUCKET_NAME/hello-s3.txt ./hello-s3.txt
These commands illustrate how S3 can be used from a terminal.
Security note: Do not put AWS access keys directly into scripts or commit credentials to a Git repository. When working on EC2, prefer an appropriately configured IAM role. For local development, use a suitable credential provider and follow AWS's credential-management recommendations.
The CLI commands will work only when the configured identity has the required permissions and the relevant bucket and object exist.

10. Understanding S3 Storage Classes

Not all objects need to be accessed equally often.
Some files are downloaded frequently, while others may be backups or archives that are rarely accessed.
Amazon S3 provides different storage classes for different access patterns.
Storage classTypical use
S3 StandardFrequently accessed data
S3 Intelligent-TieringData with changing or uncertain access patterns
S3 Standard-IAInfrequently accessed data that needs rapid retrieval
S3 One Zone-IAInfrequently accessed data where single-Availability-Zone storage is acceptable
S3 Glacier Flexible RetrievalArchive data requiring flexible retrieval times
S3 Glacier Deep ArchiveLong-term archival data with infrequent access
Each class has different pricing and operational considerations.
For example, archival storage may have lower storage costs but introduce retrieval charges, minimum storage-duration considerations, or delays before data can be retrieved.
For a beginner's first bucket, the default S3 Standard class is generally the simplest option for learning.
The important lesson is that storage choices should reflect how the application uses its data rather than being based only on the storage price.

11. Integrating S3 with a Backend Application

Let's consider how S3 fits into a real application.
Imagine we're building a document management platform with a Java Spring Boot backend.
A user uploads a PDF through the frontend.
The application could follow this workflow:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
User
|
v
Frontend
|
v
Spring Boot API
|
v
Validate Request
|
v
Upload to Amazon S3
|
v
Store Object Key in Database
The database stores metadata such as the document owner, original filename, upload time, and S3 object key.
The file itself remains in S3.
This separation offers several advantages:
  • The database doesn't need to store large binary files directly.
  • Application servers don't need to retain every uploaded file on their local disks.
  • Access to documents can be controlled independently of application compute.
  • Object storage can scale independently of the database.
A practical application should also validate file types and sizes, authenticate users, authorize access to each document, and handle failed uploads appropriately.
For sensitive documents, the backend should verify that the requesting user is permitted to access the requested object before providing a download link.

12. S3 and Presigned URLs

Uploading every file through the backend is not the only possible architecture.
For some applications, a backend can generate a presigned URL that lets the client upload a file directly to S3.
The workflow looks like this:
1
2
3
4
5
6
7
8
9
10
11
12
13
1. Request Upload
User ----------------------------> Backend
|
v
Generate Presigned URL
|
2. Return URL |
User <-------------------------------+
|
|
| 3. Upload File
v
Amazon S3
This approach can reduce the amount of file data passing through the backend server.
However, the backend must still authenticate the user, authorize the requested operation, restrict the URL's permissions and lifetime, and validate the resulting upload as appropriate.
A presigned URL is a temporary bearer credential: anyone who obtains it may be able to use it for the permitted operation until it expires or becomes invalid.
We'll explore this architecture in a future hands-on article.

13. Understanding S3 Costs

Before using S3 for a real application, it's important to understand its pricing model.
Depending on the service and configuration, costs may include:
  • Amount of data stored
  • Number and type of requests
  • Data transferred out of AWS
  • Retrieval charges for certain storage classes
  • Data-management features
  • Replication or other optional capabilities
The exact cost depends on the Region, storage class, usage, and current pricing.
For a small learning project, the amount of stored data may be tiny, but requests and other features can still have costs.
Before experimenting, review the official Amazon S3 pricing page .
Also remember to clean up test objects and buckets when you're finished, provided they don't contain data you need to retain.
Deleting a bucket requires removing its objects first in many ordinary cases, and versioned buckets may require additional cleanup of object versions and delete markers.

14. Common Beginner Mistakes

Here are some issues worth understanding early.

Mistake 1: Assuming every object is public

An S3 object URL does not automatically provide public access. Access depends on the relevant permissions and security settings.

Mistake 2: Making the entire bucket public

A public bucket can expose more data than intended. Keep buckets private unless public access is an explicit requirement.

Mistake 3: Storing AWS credentials in application code

Credentials committed to source control can be abused. Use appropriate IAM roles or supported credential-management mechanisms.

Mistake 4: Using S3 as if it were a relational database

S3 is object storage. It is not a substitute for MySQL or PostgreSQL when the application needs relational queries, transactions, or structured database operations.

Mistake 5: Ignoring storage classes and retrieval costs

A storage class that is inexpensive for storing data may be less suitable when files need to be retrieved frequently.

Mistake 6: Forgetting to clean up test resources

Unneeded objects, versions, and other storage-related features can continue to incur charges. Review your resources regularly.

15. A Small Hands-On Challenge

Now that we've covered the fundamentals, here's a practical exercise.
Create a private S3 bucket for a sample student application.
Then:
  1. Upload a text file named student-info.txt.
  2. Upload a sample PDF under the documents/ prefix.
  3. Upload an image under the profile-images/ prefix.
  4. List the objects in your bucket using the AWS CLI.
  5. Download one of the objects using the CLI.
  6. Verify that an unauthenticated request cannot access your private object.
  7. Review the bucket's permissions and encryption settings.
  8. Delete the test objects and bucket when you're finished, if you no longer need them.
Avoid uploading real personal records or sensitive documents for this exercise.
The purpose is to understand the complete object-storage workflow rather than simply clicking the Upload button.

16. What I Learned

Exploring Amazon S3 introduces several important cloud development concepts.
First, storage can be independent of compute. Files don't need to live on the same virtual machine that runs the application.
Second, object storage uses keys and APIs. S3 objects are accessed through object identifiers and supported operations rather than ordinary filesystem paths.
Third, access control matters. A file being stored in the cloud doesn't mean it should be publicly accessible.
Fourth, architecture choices affect cost. Storage class, request patterns, retrieval requirements, and data transfer all matter.
Finally, S3 integrates with other AWS services. A backend application can use S3 for file storage while a database manages application records and metadata.
These concepts become increasingly useful as we build more complex applications.

Conclusion

In this article, we explored Amazon S3, learned the difference between buckets and objects, created a bucket, uploaded files, and examined access permissions and storage classes.
We also explored how the AWS CLI can interact with S3 and how backend applications can use object storage for uploaded files and documents.
S3 is a foundational AWS service that appears in many architectures, from simple web applications to data-processing and AI systems.
In the next article, we'll move into serverless computing and explore AWS Lambda, where we can execute code without managing a traditional application server.
The goal remains the same: learn one concept at a time, build something practical, and share the lessons with other developers.
Series: Learning AWS in Public: A Student Developer's Journey
Previous: Part 3 — From Localhost to the Cloud with Amazon EC2
Next: Part 5 — Building My First Serverless Application with AWS Lambda

Official Resources

# agentic-ai# artificial-intelligence# ai-for-developers# aspiring-developer# learning-and-development

Series: AWS for Students — From Local Projects to the Cloud (4 articles)

  1. 1
    Learning AWS in Public: A Student Developer's Journey — Part 1
  2. …
  3. 4
    Learning AWS in Public — Part 4: Amazon S3 Explained — Upload, Store, and Access Files in the Cloud This article
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article