14. Amazon S3: Buckets, Objects, Policies and Presigned URLs
14.1 What S3 Is: Buckets, Objects and Keys
S3 mhanje internet var ek unlimited "file store". Pan to normal disk sarkha nahi – tyat folders nastat, fakt buckets aani objects astat. Ekdum simple chitra doktyat theva:
| Term | Meaning | Example |
|---|---|---|
| Bucket | Top-level container, name is globally unique across all AWS accounts | ravindra-reels-media-pune |
| Object | One file plus its metadata (content type, size, tags) | a video, an image, a PDF |
| Key | The full "path" name of the object inside the bucket | videos/2026/09/a1b2c3.mp4 |
| Prefix | The part of the key before the last / – the console shows it as a folder |
videos/2026/09/ |
| Region | Where the bucket physically lives; choose one close to your users | ap-south-1 (Mumbai) |
| Storage class | Price/speed trade-off for the object | Standard, Standard-IA, Glacier |
s3://ravindra-reels-media-pune/videos/2026/09/a1b2c3.mp4
└────────── bucket ─────────┘└───────────── key ─────────────┘
Object la URL pan asto: https://<bucket>.s3.<region>.amazonaws.com/<key>. Pan URL aahe mhanje to public aahe asa nahi – by default pratyek bucket aani object private asto. Ha niyam lakshat theva.
| Feature | EBS (disk on EC2) | S3 (object storage) |
|---|---|---|
| Attached to | One EC2 instance | Nothing – reached over HTTPS API |
| Size | You choose and pay for the full disk | Grows automatically, pay for what you store |
| Access | Through the operating system (ls, cp) |
Through API/CLI/SDK (aws s3 cp) |
| Best for | OS, databases, application code | Uploads, videos, images, backups, logs, static sites |
Why this matters for security
Because every object has a URL, a single wrong permission makes files downloadable by anyone on the internet – no login, no hacking skill needed. Many publicly reported data leaks were simply S3 buckets or objects left readable to "Everyone". Attackers even guess bucket names (companyname-backup, companyname-dev) and try them automatically.
Ravindra Bagale's Tip
Many students think of a bucket as a folder and name it test or mybucket for every project – and get the "name already exists" error. A bucket name is unique across the whole world. Combine the project, purpose and city/region in the name, like ravindra-reels-media-pune. And never put secret information in the name (client names, "backup", "passwords") – bucket names get guessed publicly.
Ravindra Bagale's Tip – मराठी
बरेच students bucket ला folder समजतात आणि प्रत्येक project साठी test, mybucket असं नाव देतात – आणि "name already exists" error येतो. Bucket चं नाव सगळ्या जगात unique असतं. Project, purpose आणि city/region जोडून नाव द्या, जसं ravindra-reels-media-pune. आणि नावात secret माहिती (client नाव, "backup", "passwords") कधी ठेवू नका – bucket names publicly guess केले जातात.
Ravindra Bagale's Tip – हिंदी
बहुत से students bucket को folder समझते हैं और हर project के लिए test, mybucket जैसा नाम देते हैं – और "name already exists" error आता है. Bucket का नाम पूरी दुनिया में unique होता है. Project, purpose और city/region जोड़कर नाम दो, जैसे ravindra-reels-media-pune. और नाम में secret जानकारी (client का नाम, "backup", "passwords") कभी मत रखो – bucket names publicly guess किए जाते हैं.
Practice task
Write down three bucket names for a project of your own following the rule project-purpose-place. Then split the key invoices/pune/2026/inv-101.pdf into prefix and file name.