What is S3 and what are its key features

Crisp answer: S3 (Simple Storage Service) is AWS's object storage service — infinitely scalable, highly durable (11 nines), and accessible via HTTP. Objects are stored in buckets with a key (path), and accessed via URLs.

Core concepts:

Bucket:   Global namespace container for objects. Name must be globally unique.
Object:   A file + metadata, up to 5TB. Identified by key (e.g. docs/file.pdf)
Key:      The full path of the object within the bucket
Region:   Buckets are region-specific (despite global namespace)

Storage classes:

Versioning:

# Enable versioning
aws s3api put-bucket-versioning \
  --bucket my-bucket \
  --versioning-configuration Status=Enabled

# List all versions of an object
aws s3api list-object-versions --bucket my-bucket --prefix my-file.txt

# Restore a previous version (copy it back)
aws s3api copy-object \
  --bucket my-bucket \
  --copy-source "my-bucket/my-file.txt?versionId=abc123" \
  --key my-file.txt

Encryption:

SSE-S3:    AWS manages keys (AES-256). Default since 2023. Free.
SSE-KMS:   AWS KMS manages keys. Audit trail, key rotation, access control.
SSE-C:     Customer provides keys per request. AWS does not store the key.
Client-side: Encrypt before uploading. AWS never sees plaintext.

Access control:

Bucket policy:    JSON policy on the bucket — allows/denies at bucket level
ACLs:             Legacy, mostly disabled by default now
Block Public Access: Account and bucket level setting — overrides everything

// Example: allow a specific role to read all objects
{
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::123456789:role/app-role" },
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}

S3 event notifications:

Trigger Lambda, SQS, or SNS when objects are created/deleted.
Filter by prefix (docs/) and suffix (.jpg) to target specific events.
Used for: document ingestion pipelines, image processing, audit logging.

Key operational commands:

# Copy files
aws s3 cp local-file.txt s3://my-bucket/path/
aws s3 cp s3://my-bucket/path/ ./local-dir/ --recursive

# Sync (only copies changed files)
aws s3 sync ./local-dir s3://my-bucket/path/ --delete

# List with metadata
aws s3api list-objects-v2 --bucket my-bucket --prefix docs/

# Get object metadata
aws s3api head-object --bucket my-bucket --key docs/file.pdf

# Pre-signed URL (time-limited access without credentials)
aws s3 presign s3://my-bucket/private-file.pdf --expires-in 3600

What to say in the interview:

"S3 is object storage with 11 nines durability — AWS replicates across three AZs within a region. Key features I use regularly: versioning to protect against accidental deletes, S3 event notifications to trigger Lambda for ingestion pipelines (that is the whole rag-bedrock ingest architecture), SSE-KMS for buckets that need audit trails on key access, and lifecycle policies to automatically move old objects to Glacier. The Block Public Access setting is the safety net — turn it on at the account level so no bucket can be accidentally made public."