Simple Storage Service (S3)

# Create a bucket (bucket names are globally unique)
aws s3 mb s3://my-app-bucket-2026 --region us-east-1

# Upload a file
aws s3 cp ./app.zip s3://my-app-bucket-2026/releases/app.zip

# Upload an entire directory recursively
aws s3 sync ./dist s3://my-app-bucket-2026/web/ --delete

# Download a file
aws s3 cp s3://my-app-bucket-2026/releases/app.zip ./app.zip

# List objects with their sizes
aws s3 ls s3://my-app-bucket-2026/ --recursive --human-readable

# Delete an object
aws s3 rm s3://my-app-bucket-2026/releases/old-app.zip

# lifecycle.json
{
  "Rules": [
    {
      "ID": "move-old-logs",
      "Status": "Enabled",
      "Filter": { "Prefix": "logs/" },
      "Transitions": [
        { "Days": 30,  "StorageClass": "STANDARD_IA" },
        { "Days": 90,  "StorageClass": "GLACIER" }
      ],
      "Expiration": { "Days": 365 }
    }
  ]
}

# Apply it
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-app-bucket-2026 \
  --lifecycle-configuration file://lifecycle.json

# Generate a presigned URL (expires in 3600 seconds = 1 hour)
aws s3 presign s3://my-app-bucket-2026/reports/invoice.pdf \
  --expires-in 3600

# Returns a URL like:
# https://my-app-bucket-2026.s3.amazonaws.com/reports/invoice.pdf?X-Amz-Signature=...
# Anyone with this URL can download the object until it expires

# Python equivalent using boto3
import boto3
s3 = boto3.client("s3")
url = s3.generate_presigned_url(
    "get_object",
    Params={"Bucket": "my-app-bucket-2026", "Key": "reports/invoice.pdf"},
    ExpiresIn=3600,
)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-static-site/*"
    }
  ]
}

# Apply the policy
aws s3api put-bucket-policy \
  --bucket my-static-site \
  --policy file://bucket-policy.json

# Pre-requisite: create a File System access point in the S3 Console.
# The NFS hostname is displayed in the console once the access point is ready.

# ---- EC2 / ECS host: mount via NFS4 ----
sudo mount -t nfs4 \
  -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600 \
  <nfs-hostname-from-console>.s3-accesspoint.us-east-1.amazonaws.com:/ \
  /mnt/s3files

# Standard POSIX operations - no application code changes needed
ls /mnt/s3files/training-data/
cp ./model_v2.bin /mnt/s3files/models/
cat /mnt/s3files/config/settings.json

# Objects written via NFS are immediately accessible via the S3 API
aws s3 ls s3://my-ml-bucket/models/

# Create a Storage Lens dashboard with Advanced metrics enabled
aws s3control put-storage-lens-configuration \
  --account-id 123456789012 \
  --config-id my-org-lens \
  --storage-lens-configuration file://lens-config.json

# lens-config.json
{
  "Id": "my-org-lens",
  "IsEnabled": true,
  "AccountLevel": {
    "ActivityMetrics": { "IsEnabled": true },
    "BucketLevel": {
      "ActivityMetrics": { "IsEnabled": true },
      "PrefixLevel": {
        "StorageMetrics": {
          "IsEnabled": true,
          "SelectionCriteria": { "MaxDepth": 2, "MinStorageBytes": 1048576 }
        }
      }
    }
  },
  "DataExport": {
    "S3BucketDestination": {
      "Format": "Parquet",
      "OutputSchemaVersion": "V_1",
      "AccountId": "123456789012",
      "Arn": "arn:aws:s3:::my-lens-exports"
    }
  }
}