Should I make a bucket public to host files?

Avoid it unless public access is truly the goal. For websites, serve through a CDN such as CloudFront with the bucket kept private, and use presigned URLs for temporary sharing of private objects.

Why does my bucket name get rejected?

Names must be globally unique and follow naming rules such as lowercase letters, numbers, and hyphens. Add something unique like your name or a random number.

Amazon S3 Basics: Buckets, Objects, Versioning, and Safe Sharing

Introduction

Amazon S3 is AWS's object storage service, used for backups, website assets, data lakes, and application files. It stores objects inside buckets and scales without any capacity planning. This lesson creates a bucket, moves files in and out with the CLI, adds versioning, shares a file safely, and cleans up.

Prerequisites

AWS CLI configured (previous lesson)
A budget set up

Step-by-Step Guide

Step 1: Understand buckets and objects

A bucket is a container, and an object is a file plus its metadata, identified by a key such as reports/2026/summary.pdf. Bucket names are globally unique across all AWS customers, and each bucket lives in one region. S3 has a flat structure; folders in the console are really just key prefixes.

Step 2: Create a bucket with safe defaults

Choose a unique name and a region. Outside us-east-1 you must pass a location constraint matching the region, and for us-east-1 you leave it out. New buckets block public access by default, and setting Object Ownership to bucket owner enforced keeps ACLs disabled, which is the recommended simple model. Setting it explicitly avoids depending on defaults that can differ by tool.

aws s3api create-bucket \
  --bucket my-unique-bucket-name-12345 \
  --region us-west-2 \
  --create-bucket-configuration LocationConstraint=us-west-2 \
  --object-ownership BucketOwnerEnforced

Step 3: Upload, list, and download

The high-level s3 commands behave like file commands. cp copies a single file, and sync copies a whole folder, transferring only what changed.

echo "hello cloud" > hello.txt

aws s3 cp hello.txt s3://my-unique-bucket-name-12345/
aws s3 ls s3://my-unique-bucket-name-12345/
aws s3 cp s3://my-unique-bucket-name-12345/hello.txt downloaded.txt

aws s3 sync ./site s3://my-unique-bucket-name-12345/site

Step 4: Turn on versioning

Versioning keeps every version of an object, so an accidental overwrite or delete can be undone. It is off by default. Remember that old versions are stored and billed too, and a lifecycle rule can expire them after a set time.

aws s3api put-bucket-versioning \
  --bucket my-unique-bucket-name-12345 \
  --versioning-configuration Status=Enabled

Step 5: Share a file without making it public

A presigned URL grants temporary access to one private object, and it stops working after the expiry time you set. This is far safer than making a bucket public. Anyone holding the link can use it until it expires, so keep the lifetime short.

aws s3 presign s3://my-unique-bucket-name-12345/hello.txt --expires-in 3600

Step 6: Clean up

Delete what you created so it does not keep billing. The remove-bucket command with force deletes every object in the bucket first, so double-check the name. If versioning was enabled, older versions remain and the bucket will not delete until all versions are removed, which the console's empty bucket action handles.

aws s3 rb s3://my-unique-bucket-name-12345 --force

FAQs

Should I make a bucket public to host files?: Avoid it unless public access is truly the goal. For websites, serve through a CDN such as CloudFront with the bucket kept private, and use presigned URLs for temporary sharing of private objects.
Why does my bucket name get rejected?: Names must be globally unique and follow naming rules such as lowercase letters, numbers, and hyphens. Add something unique like your name or a random number.

Summary

S3 stores objects in globally uniquely named buckets. Create buckets with public access blocked, move files with s3 cp and sync, use versioning for protection, share with presigned URLs instead of public buckets, and delete test buckets when finished.