Question 1

What is Amazon S3?

Accepted Answer

S3 is object storage. You store files as objects — up to 5 TB each — inside buckets with globally unique names, addressed by key over HTTP, with eleven nines of durability. It is used for backups, static assets, data lakes, logs and media, and it scales without you provisioning capacity. The framing to give is object storage, not a filesystem: there are no real directories, and the slashes in a key are just characters that the console renders as folders. Candidates who describe S3 as a mounted disk usually stumble on the next question.

Question 2

What are the S3 storage classes?

Accepted Answer

Standard for frequent access; Intelligent-Tiering which moves objects automatically based on access patterns; Standard-Infrequent Access and One Zone-IA for less frequent access with a 30-day minimum; Glacier Instant Retrieval for archive with millisecond access; Glacier Flexible Retrieval for minutes-to-hours retrieval; and Glacier Deep Archive for the cheapest storage with hours-long retrieval and a 180-day minimum. The traps to name are the minimum storage durations and the per-object retrieval fees — deleting an IA object after a week still bills 30 days. One Zone-IA is also worth flagging as the one class that loses data if its single AZ is destroyed, so it is only for reproducible data.

Question 3

What is S3 Intelligent-Tiering and when would you use it?

Accepted Answer

Intelligent-Tiering monitors access patterns per object and moves each between frequent, infrequent and optional archive tiers automatically, with no retrieval fees for the automatic tiers and a small per-object monitoring charge. It is the right default when access patterns are unknown or variable. The economics to name: the monitoring fee is per object, so it is poor value for buckets with an enormous number of very small objects, where the fee can exceed the storage saving. Objects under 128 KB are not monitored or tiered at all.

Question 4

What consistency model does S3 provide?

Accepted Answer

Since December 2020, S3 provides strong read-after-write consistency for all operations — PUT of new objects, overwrites and deletes — and for list operations, at no additional cost and with no performance penalty. Previously overwrites and listings were eventually consistent. Knowing the current behaviour matters because a lot of older material and many candidates still describe S3 as eventually consistent. It also removed a whole class of workaround code in data pipelines, which is worth mentioning as the practical impact.

Question 5

What is S3 versioning and what does it protect against?

Accepted Answer

Versioning keeps every version of an object, so an overwrite creates a new version and a delete places a delete marker rather than destroying data. It protects against accidental deletion, application bugs and, combined with MFA delete and Object Lock, against malicious destruction. The cost warning is essential: noncurrent versions are billed as ordinary storage and accumulate invisibly, so versioning must always be paired with a lifecycle rule expiring noncurrent versions. A bucket with versioning and frequent overwrites grows without bound.

Question 6

What is an S3 lifecycle policy?

Accepted Answer

A set of rules that transition objects between storage classes or expire them based on age, prefix, tags or object size, and that can expire noncurrent versions and abort incomplete multipart uploads. It is how storage cost is managed without manual intervention. Aborting incomplete multipart uploads is the rule most people forget, and orphaned parts from failed uploads accumulate and are billed indefinitely with no visibility in the object listing. Adding that rule to every bucket is standard hygiene.

Question 7

How do you control access to S3?

Accepted Answer

Through IAM identity policies attached to users and roles, bucket policies attached to the bucket as resource policies, S3 Access Points for named access configurations, and — legacy — ACLs. Block Public Access settings sit above all of them and override any grant that would make data public. Current best practice is to disable ACLs entirely with bucket owner enforced object ownership, so access is governed only by IAM and bucket policies and is therefore auditable. ACLs made "who can read this bucket" unanswerable, which is exactly why they were deprecated.

Question 8

What is S3 Block Public Access?

Accepted Answer

A set of four settings, available at account and bucket level, that block public ACLs and public bucket policies regardless of what is configured. Enabled at the account level, it makes it impossible for anyone to accidentally expose a bucket, even with full S3 permissions. This is the control that closed the era of accidentally-public S3 buckets, and it is now on by default for new buckets. Naming account-level enforcement rather than per-bucket is the stronger answer, because per-bucket relies on someone remembering.

Question 9

What is a presigned URL and when would you use one?

Accepted Answer

A presigned URL grants time-limited permission to perform a specific operation — usually GET or PUT — on a specific object, to anyone holding the URL, without them having AWS credentials. It is generated by signing with an existing identity's credentials. The architectural value is that the client transfers bytes directly to or from S3, bypassing your application servers entirely, so you do not pay to proxy bandwidth and do not size compute for file transfer. Keep the expiry short, and remember the URL inherits the permissions of the signing identity.

Question 10

How does S3 encryption work and what are the options?

Accepted Answer

All new objects are encrypted at rest by default with SSE-S3. Alternatives are SSE-KMS using a KMS key you control, with auditability and revocation; SSE-C where you supply the key with every request and AWS does not store it; and client-side encryption where you encrypt before upload. The SSE-KMS cost and throughput consideration is the practical detail: every object operation makes a KMS call, which is charged and subject to KMS request quotas. S3 Bucket Keys reduce those calls dramatically and are the fix for high-volume workloads.

Question 11

What is an S3 Bucket Key?

Accepted Answer

A bucket-level key that S3 uses to generate data keys locally instead of calling KMS for every object, reducing KMS API calls and cost by up to 99% for buckets with high object operation rates, while still using your KMS key as the root of trust. It is the answer to "SSE-KMS made our costs and latency worse" — a real problem for data lakes with millions of small objects. Knowing it exists and is a one-setting change is genuinely valuable operational knowledge.

Question 12

What is S3 Object Lock?

Accepted Answer

Object Lock enforces write-once-read-many retention: in governance mode, users with special permission can override; in compliance mode, nobody including the root user can delete or modify the object until the retention period expires. Legal holds place an indefinite lock independent of the retention period. Compliance mode is what satisfies regulatory record-keeping such as SEC 17a-4, and it is also the strongest defence against ransomware, since an attacker with full account access still cannot destroy the data. The irreversibility is the risk, so it should be tested in a non-production bucket first.

Question 13

What is S3 Replication and what are the two types?

Accepted Answer

Cross-Region Replication copies objects to a bucket in another region for disaster recovery, latency reduction or compliance. Same-Region Replication copies within a region, typically for log aggregation, account separation or compliance. Both require versioning on source and destination, and replicate asynchronously. Two facts to include: replication only applies to objects created *after* it is enabled unless you run batch replication for existing ones, and S3 Replication Time Control gives a 15-minute SLA for those needing a guaranteed recovery point. Cross-account replication into a separate account is also the standard ransomware-resilience pattern.

Question 14

What is multipart upload and why does it matter?

Accepted Answer

Multipart upload splits a large object into parts uploaded in parallel and independently retryable, then combines them. It is required above 5 GB and recommended above 100 MB, improving throughput and resilience because a failed part is retried rather than the whole object. The cost trap is incomplete uploads: parts from a failed or abandoned upload are stored and billed but do not appear in the object listing. A lifecycle rule aborting incomplete multipart uploads after a few days is the fix, and forgetting it is a common source of unexplained storage cost.

Question 15

How do you optimise S3 performance?

Accepted Answer

S3 scales to at least 3,500 PUT/COPY/POST/DELETE and 5,500 GET/HEAD requests per second per prefix, so spreading keys across prefixes multiplies throughput. Use multipart upload and parallel range GETs for large objects, S3 Transfer Acceleration for long-distance uploads, and CloudFront for repeated reads. The prefix guidance changed over time: random hash prefixes used to be essential and are now only needed to exceed per-prefix limits, since S3 auto-partitions. Knowing the current per-prefix numbers rather than repeating the old "always randomise" advice shows currency.

Question 16

What is S3 Transfer Acceleration?

Accepted Answer

Transfer Acceleration routes uploads through the nearest CloudFront edge location and onto the AWS backbone to the bucket's region, improving throughput for clients far from the bucket. It is enabled per bucket and charged per GB on top of normal transfer. The honest qualification is that it helps for long-distance, high-latency transfers and can be slower than a direct upload for nearby clients — AWS provides a speed comparison tool for exactly this reason. Recommending it unconditionally is a mistake.

Question 17

What is S3 Select and how does it differ from Athena?

Accepted Answer

S3 Select retrieves a subset of a single object using simple SQL, pushing the filter into S3 so less data crosses the network. Athena runs full SQL across many objects with joins, aggregations and partition pruning, using a table definition in the Glue Data Catalog. The rule is S3 Select for a targeted read from one file, Athena for analytics across a dataset. Note that AWS now steers most use cases towards Athena or object-level filtering in the client, so S3 Select is a narrower tool than it first appears.

Question 18

How do you host a static website on S3?

Accepted Answer

Upload the site, and either enable S3 static website hosting for a simple HTTP endpoint, or — the production pattern — keep the bucket private and put CloudFront in front with Origin Access Control, an ACM certificate for your domain, and Route 53 alias records. CloudFront gives HTTPS, caching, custom errors and WAF. The private-bucket-with-OAC pattern is what interviewers want, because the website endpoint alone requires a public bucket and supports no HTTPS on a custom domain. Origin Access Control replaced the older Origin Access Identity and is the current mechanism.

Question 19

What is Origin Access Control?

Accepted Answer

OAC lets CloudFront authenticate to a private S3 bucket using SigV4, so the bucket policy can allow only that CloudFront distribution and deny everyone else. It replaced Origin Access Identity and supports all regions, SSE-KMS and all HTTP methods. The security outcome is that the bucket is never public and cannot be accessed by bypassing CloudFront, which matters because bypassing the CDN also bypasses WAF, logging and signed URLs. Naming that bypass risk is what makes the answer complete.

Question 20

What is an S3 event notification and what can it trigger?

Accepted Answer

S3 can publish events on object creation, removal, restore, replication and lifecycle transitions to SNS, SQS, Lambda, or through EventBridge. EventBridge gives richer filtering and more targets, and is now the recommended route for complex routing. The reliability point is that delivery is at-least-once, so handlers must be idempotent. The other trap is recursion: a function triggered by object creation that writes back to the same bucket invokes itself indefinitely, which is a well-known runaway-cost incident.

Question 21

What is an S3 Access Point?

Accepted Answer

An Access Point is a named network endpoint attached to a bucket with its own policy and optional VPC restriction, so different applications get different, simpler access configurations without one enormous bucket policy. Multi-Region Access Points route requests to the nearest replica. The problem it solves is bucket policy sprawl: a shared data lake bucket accumulating dozens of statements becomes unreviewable and hits the policy size limit. Per-consumer access points keep each policy small and comprehensible.

Question 22

How is S3 priced?

Accepted Answer

Storage per GB-month by class and region; requests priced per thousand and differing by type; data transfer out to the internet per GB, with transfer in free; retrieval fees for IA and Glacier classes; and charges for features such as replication, Intelligent-Tiering monitoring and Object Lambda. The bill surprise interviewers probe is request and retrieval cost rather than storage: a job listing millions of objects repeatedly, or reading from Glacier frequently, can cost more than the storage itself. Always model operations, not just capacity.

Question 23

How would you investigate an unexpectedly high S3 bill?

Accepted Answer

Break the cost down by usage type in Cost Explorer — storage, requests by class, retrieval, transfer. Then use S3 Storage Lens for organisation-wide metrics and Storage Class Analysis per bucket. Common causes are noncurrent versions with no expiry rule, incomplete multipart uploads, high LIST volume, cross-region transfer, and premature Glacier retrievals. Naming S3 Storage Lens specifically is the differentiator, because it surfaces exactly these issues — incomplete uploads, noncurrent version share, request patterns — across an entire organisation rather than one bucket at a time.

Question 24

What is S3 Storage Lens?

Accepted Answer

Storage Lens gives organisation-wide visibility into object storage usage and activity — total storage, object counts, request rates, noncurrent version share, incomplete multipart upload bytes, encryption and public access status — with dashboards, recommendations and metrics export. The recommendations are actionable rather than descriptive: it points at buckets missing lifecycle rules, holding large amounts of noncurrent data, or with unusual request patterns. It is the tool that turns S3 cost management from guesswork into a task list.

Question 25

What is the difference between S3 and EFS and EBS?

Accepted Answer

S3 is object storage accessed over an API, effectively unlimited, shared globally. EBS is block storage attached to one EC2 instance at a time (except multi-attach for specific cases), presented as a raw device. EFS is managed NFS providing a POSIX filesystem that many instances can mount read-write simultaneously. The selection question behind this is usually "my application needs a shared filesystem" — the answer is EFS, not S3, because legacy applications expect POSIX semantics like partial writes and file locking. Mountpoint for S3 exists but has real semantic caveats worth naming.

Question 26

What is S3 Object Lambda?

Accepted Answer

Object Lambda runs a Lambda function on the response of a GET, HEAD or LIST through an access point, so you can transform data as it is retrieved — redacting PII for one consumer, converting formats, resizing images — without storing multiple copies. The value is a single source of truth with per-consumer views, avoiding the storage cost and consistency problems of maintaining derived copies. The cost is latency and Lambda charges on every request, so it suits low-to-moderate request rates.

Question 27

How do you make S3 data resilient against ransomware?

Accepted Answer

Enable versioning so overwrites do not destroy data; enable Object Lock in compliance mode so objects cannot be deleted before their retention expires; replicate to a bucket in a separate account with a different trust boundary; enable MFA delete; and restrict s3:DeleteObject and s3:PutBucketVersioning to a small set of principals with SCP guardrails. The layered answer is what matters — versioning alone is defeated by an attacker who deletes versions, and same-account replication shares the blast radius. Compliance-mode Object Lock plus cross-account copies is the combination that actually holds.

Question 28

What is the difference between a bucket policy and an IAM policy for S3?

Accepted Answer

An IAM policy attaches to a principal and says what that identity can do. A bucket policy attaches to the bucket and says who may access it, including principals in other accounts and anonymous access. For cross-account access you generally need both — a grant in the resource policy and a permission in the caller's identity policy. The both-sides requirement for cross-account is the specific fact interviewers check, and it is why cross-account S3 access fails in ways people find confusing. Bucket policies are also the only place to express conditions like requiring TLS or a specific VPC endpoint.

Question 29

How do you enforce that S3 objects are only accessed over TLS?

Accepted Answer

Add a Deny statement to the bucket policy conditioned on aws:SecureTransport being false, which blocks any request over plain HTTP regardless of other grants. This is a standard control and is checked by Config rules and Security Hub. The reason an explicit deny is needed is that S3 accepts HTTP by default, so allowing TLS is not enough — you must deny the alternative. Being able to write the condition key from memory is a small but convincing detail.

Question 30

What is S3 Batch Operations?

Accepted Answer

Batch Operations performs a single action across billions of objects listed in a manifest — copy, tag, restore from Glacier, invoke a Lambda function, replicate, or set Object Lock retention — with progress tracking, retries and a completion report. It is the answer to "how would you re-encrypt or re-tag ten million existing objects" — hand-rolled scripts fail partway with no resumability. Batch replication for objects that predate a replication rule is the other common use.

Question 31

What is the maximum object size in S3 and what are the key limits?

Accepted Answer

Maximum object size is 5 TB, with a single PUT limited to 5 GB so larger objects require multipart upload. Bucket names are globally unique, 3–63 characters and DNS-compliant. There is a default limit on buckets per account, and bucket policies have a size limit which is why access points exist. Global bucket-name uniqueness is the one that catches freshers — you cannot simply name a bucket "backups". It also means bucket names leak information, so avoid embedding customer or project names that should stay private.

Question 32

How would you migrate 200 TB of on-premises data into S3?

Accepted Answer

Calculate transfer time over available bandwidth first. If feasible, use DataSync, which handles parallelism, integrity verification, scheduling and incremental sync far better than a script. If the network would take months, use Snowball Edge devices shipped to you. For ongoing sync, DataSync runs recurring incremental tasks. Doing the arithmetic is what makes the answer credible: 200 TB over a saturated 1 Gbps link is roughly 20 days at perfect efficiency, and real efficiency is much lower. Rejecting "we will run the CLI in a loop" as a plan is part of the answer.

Question 33

What is AWS DataSync?

Accepted Answer

DataSync is a managed data transfer service that moves data between on-premises storage, S3, EFS, FSx and other clouds, at high speed with parallel transfers, integrity verification, bandwidth throttling, scheduling and incremental sync. The reason to prefer it over scripts is verification and resumability — a hand-rolled copy that fails silently on a subset of files is a real and hard-to-detect problem. Naming its ability to preserve metadata and permissions matters for file-share migrations.

Question 34

What is S3 Glacier retrieval and what are the options?

Accepted Answer

Glacier Instant Retrieval gives millisecond access. Glacier Flexible Retrieval offers expedited (1–5 minutes), standard (3–5 hours) and bulk (5–12 hours) retrievals. Glacier Deep Archive offers standard (within 12 hours) and bulk (within 48 hours). Retrieval is charged per GB and per request. The design consequence is that Deep Archive is unsuitable for anything with a recovery-time objective under a day, so it is for compliance retention rather than backup you might actually need quickly. Matching the class to the RTO is the decision being tested.

Question 35

How do you audit who accessed an S3 object?

Accepted Answer

Enable CloudTrail data events for S3, which record object-level GET, PUT and DELETE with the caller identity — they are off by default because of volume and cost. S3 server access logs are an alternative with different fields and best-effort delivery. Route both to a separate, restricted account. The default-off point is what catches people during an incident: management-event CloudTrail records the bucket being created but not who read the data. Enabling data events selectively on sensitive buckets, rather than everywhere, is the practical balance.

Question 36

What is the difference between deleting an object and deleting a version?

Accepted Answer

In a versioned bucket, a DELETE on the object key adds a delete marker and hides the object without removing data; the versions remain and are still billed. Deleting a specific version identifier permanently removes that version. Restoring is simply removing the delete marker. This is why versioning protects against accidental deletion and why storage does not drop when you "delete" objects. It is also why an attacker must delete versions specifically, which is what MFA delete and Object Lock prevent.

Question 37

What is S3 Mountpoint and what are its limitations?

Accepted Answer

Mountpoint for Amazon S3 is a file client that lets applications read S3 objects through file operations, optimised for high-throughput sequential reads. It does not support random writes, renames, directory operations or POSIX file locking, because those do not map onto object storage semantics. The correct framing is a compatibility bridge for read-heavy workloads, not a filesystem. Anything expecting real POSIX behaviour — a database, a lock file, an application doing partial writes — needs EFS or FSx instead.

Question 38

How do you organise an S3 data lake?

Accepted Answer

Partition keys by a hierarchy the query engine can prune — typically source, dataset and date, such as raw/orders/year=2026/month=08/day=24/. Use columnar formats like Parquet, compact small files into reasonably large ones, separate raw, curated and aggregate zones by prefix or bucket, and register tables in the Glue Data Catalog. Hive-style partition keys are what let Athena and Redshift Spectrum prune, and the small-file problem is what kills performance and cost in practice. Naming compaction as an explicit pipeline step, not an afterthought, is the mark of experience.

Question 39

What is the small-files problem in S3 and how do you fix it?

Accepted Answer

Query engines pay a per-file overhead for listing, opening and scheduling, so millions of tiny files make a job spend most of its time on metadata rather than data. The fix is compaction into files of a few hundred megabytes in a columnar format, run as a scheduled job or by tuning the writer's output shard count. It is especially acute on object storage because each file open is a network request rather than a local seek. Naming the target file size and the writer-side fix — controlling output partitions rather than compacting afterwards — is the more efficient answer.

Question 40

Design the storage layer for an application ingesting 3 TB of logs daily, queried for 30 days and retained for 7 years.

Accepted Answer

Land raw logs in S3 Standard partitioned by date, in a compressed columnar format after a compaction step. Query the 30-day window with Athena over the Glue catalog. A lifecycle rule transitions to Standard-IA at 30 days, Glacier Instant or Flexible at 90, Deep Archive at one year, expiring at seven. Enable versioning with a noncurrent expiry rule, abort incomplete multipart uploads, apply Object Lock if the retention is a regulatory obligation, and replicate to a separate account for resilience. The closing scenario. The senior markers are separating the query tier from the retention tier, matching the archive class to the actual recovery-time requirement rather than picking the cheapest, and remembering the two hygiene lifecycle rules that most designs omit.

AWS S3 Interview Questions and Answers

How to use this set