☁ AWS Cloud Engineer JourneyBeginner → Cloud Practitioner → Solutions Architect

Day 6Storage · Lab⏱ 3–4h

S3: Storage That Never Fills Up (Weekend Lab)

By the end of today you can Create buckets, upload objects, control access, enable versioning, host a static website, and pick the right storage class.

1. First principles: block, file and object storage

There are three ways to store data, and mixing them up is the most common beginner mistake.

TypeAnalogyAWSUse
BlockA hard drive inside one computerEBSOS disks, databases
FileA shared office network driveEFSMany servers share folders
ObjectA cloud locker where you hand over a file and get a ticket (URL) backS3Images, backups, logs, websites, data lakes

S3 (Simple Storage Service): you create a bucket (globally unique name, lives in one Region) and put objects (file + metadata, up to 5 TB each) in it. There are no real folders, just keys like photos/2026/cat.jpg. It is designed for 99.999999999% (11 nines) durability: data is stored redundantly across at least 3 AZs.

You / app Bucket: my-lab-bucket-2026-x7 index.htmllogo.pngbackups/2026-10/db.sql.gz Replicated across ≥3 AZs automatically HTTPS API Visitors 🌍
Private by default. You decide who can read.

2. Storage classes: pay less for data you touch less

Analogy: your homeThings you use daily sit on the desk (Standard). Seasonal items go in the cupboard (Infrequent Access). Old tax papers go in the loft (Glacier): cheap to keep, slower to fetch.
ClassUse
StandardFrequently accessed
Intelligent-TieringUnknown/changing access: AWS moves it for you
Standard-IA / One Zone-IARare access, millisecond retrieval (One Zone = single AZ, cheaper, less resilient)
Glacier Instant / Flexible / Deep ArchiveArchives; retrieval from minutes to hours; cheapest

Lifecycle rules move or delete objects automatically after N days.

3. Lab part A: bucket, upload, access

  1. S3 → Create bucket. Name globally unique, e.g. sylvester-lab-2026-12345. Same Region as your other labs. Keep Block all public access ON.
  2. Upload your nginx-lab/html/index.html. Click the object → open its Object URL. You get AccessDenied: private by default (correct!).
  3. Click Open (pre-signed temporary URL). It works for a few minutes. That is how apps share private files safely.
  4. From the CLI: 
    echo "hello s3" > hello.txt
aws s3 cp hello.txt s3://YOUR-BUCKET/ --profile lab
aws s3 ls s3://YOUR-BUCKET/ --profile lab
aws s3 presign s3://YOUR-BUCKET/hello.txt --expires-in 120 --profile lab

Lab part B: versioning (your safety net)

  1. Bucket → Properties → Bucket Versioning → Enable.
  2. Edit hello.txt locally ("hello v2") and upload again. In the console toggle Show versions: both exist.
  3. Delete the object. It just adds a delete marker. Show versions, delete the marker, and your file is back. Ransomware and fat-finger insurance.

Lab part C: static website

  1. Create a new bucket for the site. Upload index.html and a simple error.html.
  2. Properties → Static website hosting → Enable, index index.html, error error.html.
  3. Permissions → turn off "Block all public access" for this bucket only and acknowledge the warning, then add a bucket policy (swap in your bucket name): 
    {
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "PublicRead",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::YOUR-SITE-BUCKET/*"
  }]
}
  4. Open the Bucket website endpoint (Properties → bottom). Your page is live. No server to manage! Note it is HTTP only; HTTPS comes later with CloudFront.
  5. Add a lifecycle rule on the first bucket: transition to Standard-IA after 30 days (just create it; you don't need to wait).
  6. Cleanup: empty then delete both buckets (versioned buckets: "Empty" removes all versions). Storage is cheap but tidy habits are free.
📸 Evidence: evidence/day06-s3-website.png, evidence/day06-versions.png. Commit the policy JSON to aws-course/labs/ with the bucket name replaced by a placeholder.

4. Exam notes

Remember

5. Quiz

Q1. Archive compliance records for 7 years at lowest cost, retrieval within 12 hours OK.S3 Glacier Deep Archive.
Q2. Access pattern unpredictable. Which class?S3 Intelligent-Tiering.
Q3. A user accidentally deletes an object in a versioned bucket. Recovery?Remove the delete marker / restore the previous version.
Q4. Do you need a server to host a static website?No. S3 static website hosting.
Q5. Which storage would you attach to an EC2 instance as its boot disk?EBS (block storage), not S3.

6. Checklist