S3

S3 is durable object storage for uploads, static assets, backups, and build artifacts. Buckets are globally unique; objects are addressed by key. Strong read-after-write consistency applies to all operations — design uploads and listing flows with that in mind.

| Mechanism | Use | |-----------|-----| | Presigned URL | Browser or mobile direct upload/download | | Bucket policy | Cross-account and public access rules | | Lifecycle rule | Transition to IA/Glacier or expire old objects | | SSE-KMS / SSE-S3 | Encryption at rest |

Block public access by default. Serve static front-end assets through CloudFront with OAI/OAC rather than public buckets. For Node.js APIs, generate short-lived presigned URLs instead of proxying large files through Express.

On interviews: consistency model, versioning, multipart upload, event notifications to Lambda/SQS, and preventing accidental public exposure.

Common pitfalls: public `ACL` on user uploads; long-lived presigned URLs; listing millions of keys without pagination; relying on S3 as a database with frequent small updates.

The trade-off is extremely durable cheap storage versus lack of POSIX semantics, query flexibility, and fine-grained per-object locking without extra patterns.

Checklist:

• Keep buckets private; use CloudFront for static delivery.
• Encrypt objects and restrict IAM to least privilege.
• Use lifecycle rules for cost and retention compliance.
• Presign uploads/downloads; validate content type and size server-side.