AWS S3 Complete Guide: Buckets, Permissions and CLI Commands

Overview

This tutorial covers everything you need to work confidently with Amazon S3 (Simple Storage Service) — from creating and configuring buckets to managing permissions with IAM policies and bucket policies. You'll run real AWS CLI commands and understand how S3 fits into the broader AWS ecosystem.

Prerequisites:

• AWS account with IAM user or role access
• AWS CLI v2 installed and configured (aws configure)
• Basic understanding of JSON and Linux/bash

Why this matters for SAA-C03: S3 is one of the most heavily tested services on the AWS Solutions Architect Associate exam. Expect questions on storage classes, bucket policies, versioning, replication, lifecycle rules, and access control. Hands-on experience is the fastest path to retention.

Getting Started

First, confirm your AWS CLI is installed and authenticated:

# Check CLI version (requires v2)
aws --version

# Configure credentials and default region
aws configure
# AWS Access Key ID: YOUR_KEY
# AWS Secret Access Key: YOUR_SECRET
# Default region name: us-east-1
# Default output format: json

Create your first S3 bucket. Bucket names must be globally unique across all AWS accounts:

# Create a bucket (us-east-1 does NOT use LocationConstraint)
aws s3api create-bucket \
  --bucket my-cloudninjas-demo-2024 \
  --region us-east-1

# Create a bucket in any OTHER region (LocationConstraint required)
aws s3api create-bucket \
  --bucket my-cloudninjas-west-2024 \
  --region us-west-2 \
  --create-bucket-configuration LocationConstraint=us-west-2

List all buckets in your account:

aws s3api list-buckets --query "Buckets[].Name" --output table

Working with Objects and the S3 CLI

AWS provides two S3 CLI interfaces: s3 (high-level, recursive) and s3api (low-level, full API access). Know both for the exam and real-world use.

# Upload a single file
aws s3 cp ./app-config.json s3://my-cloudninjas-demo-2024/configs/app-config.json

# Upload an entire directory recursively
aws s3 cp ./dist/ s3://my-cloudninjas-demo-2024/frontend/ --recursive

# Sync local folder to S3 (only uploads changed files)
aws s3 sync ./dist/ s3://my-cloudninjas-demo-2024/frontend/ --delete

# Download a file
aws s3 cp s3://my-cloudninjas-demo-2024/configs/app-config.json ./downloads/

# List objects in a bucket
aws s3 ls s3://my-cloudninjas-demo-2024/ --recursive --human-readable

# Delete a specific object
aws s3 rm s3://my-cloudninjas-demo-2024/configs/app-config.json

# Delete all objects in a prefix (folder)
aws s3 rm s3://my-cloudninjas-demo-2024/frontend/ --recursive

Common pitfall: The --delete flag on s3 sync removes files in the destination that no longer exist in the source. Never use this flag carelessly on production buckets — it is destructive and does not prompt for confirmation.

Enable versioning to protect against accidental deletes and overwrites:

# Enable versioning
aws s3api put-bucket-versioning \
  --bucket my-cloudninjas-demo-2024 \
  --versioning-configuration Status=Enabled

# Check versioning status
aws s3api get-bucket-versioning --bucket my-cloudninjas-demo-2024

# List all versions of objects (including delete markers)
aws s3api list-object-versions \
  --bucket my-cloudninjas-demo-2024 \
  --query "Versions[].{Key:Key,VersionId:VersionId}" \
  --output table

Bucket Policies, ACLs and Block Public Access

S3 access control has multiple layers. Understanding their hierarchy is critical for both real deployments and the exam: IAM policies control what a user/role can do; bucket policies are resource-based and control who can access the bucket; ACLs are legacy and largely deprecated in favor of policies.

By default, Block Public Access is enabled on all new buckets — this is AWS best practice. To host a static website or share public assets, you must explicitly disable it:

# Disable Block Public Access (only do this when intentionally public)
aws s3api put-public-access-block \
  --bucket my-cloudninjas-demo-2024 \
  --public-access-block-configuration \
  BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false

# Confirm current Block Public Access settings
aws s3api get-public-access-block --bucket my-cloudninjas-demo-2024

Apply a bucket policy to make objects publicly readable (static website hosting use case):

# Save this as bucket-policy.json
cat > bucket-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudninjas-demo-2024/*"
    }
  ]
}
EOF

# Apply the bucket policy
aws s3api put-bucket-policy \
  --bucket my-cloudninjas-demo-2024 \
  --policy file://bucket-policy.json

# Read the current policy
aws s3api get-bucket-policy \
  --bucket my-cloudninjas-demo-2024 \
  --query Policy \
  --output text | python3 -m json.tool

For cross-account or service access (e.g., allowing CloudFront to read S3), use an Origin Access Control (OAC) policy instead of public access. A least-privilege cross-account bucket policy looks like this:

cat > cross-account-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountRead",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/ReadOnlyS3Role"
      },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-cloudninjas-demo-2024",
        "arn:aws:s3:::my-cloudninjas-demo-2024/*"
      ]
    }
  ]
}
EOF

aws s3api put-bucket-policy \
  --bucket my-cloudninjas-demo-2024 \
  --policy file://cross-account-policy.json

Common pitfall: s3:ListBucket applies to the bucket ARN itself (arn:aws:s3:::bucket-name). s3:GetObject and s3:PutObject apply to the objects ARN (arn:aws:s3:::bucket-name/*). Getting these wrong is a frequent real-world and exam mistake.

Enable server-side encryption by default using SSE-S3 (AES-256):

aws s3api put-bucket-encryption \
  --bucket my-cloudninjas-demo-2024 \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "AES256"
      },
      "BucketKeyEnabled": true
    }]
  }'

# Verify encryption is configured
aws s3api get-bucket-encryption --bucket my-cloudninjas-demo-2024

Exam Tips for AWS Solutions Architect Associate (SAA-C03)

S3 questions on the SAA-C03 exam test both conceptual knowledge and scenario-based reasoning. Focus on these areas:

• Storage Classes: S3 Standard (frequent access), S3 Standard-IA (infrequent, retrieval fee), S3 One Zone-IA (single AZ, cheaper), S3 Glacier Instant/Flexible/Deep Archive (archival, increasing retrieval time). Use S3 Intelligent-Tiering when access patterns are unknown.
• Versioning: Once enabled, versioning can only be suspended — never fully disabled. Suspended versioning preserves existing versions.
• MFA Delete: Requires MFA to permanently delete object versions. Can only be enabled by the root account user via CLI.
• Replication: Cross-Region Replication (CRR) and Same-Region Replication (SRR) both require versioning enabled on source and destination. Replication does not retroactively copy existing objects.
• Pre-signed URLs: Grant temporary access to private objects. Generated by the CLI or SDK using the caller's credentials. Expire after a defined time.
• Access Points: Simplify access management for shared datasets by creating unique hostnames per application or team.

Common exam scenarios:

1. A company needs to host a static website on S3 — enable static website hosting, disable Block Public Access, apply a public read bucket policy.
2. An application needs temporary access to a private S3 object — use a pre-signed URL.
3. Compliance requires all S3 data to be encrypted at rest — enforce SSE-S3 or SSE-KMS via bucket policy denying unencrypted PutObject requests.
4. Prevent accidental deletion of critical data — enable Versioning and MFA Delete and/or S3 Object Lock.

Quick reference commands:

# Generate a pre-signed URL valid for 1 hour
aws s3 presign s3://my-cloudninjas-demo-2024/configs/app-config.json \
  --expires-in 3600

# Enable static website hosting
aws s3api put-bucket-website \
  --bucket my-cloudninjas-demo-2024 \
  --website-configuration '{
    "IndexDocument": {"Suffix": "index.html"},
    "ErrorDocument": {"Key": "error.html"}
  }'

# Add a lifecycle rule to transition to Glacier after 90 days
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-cloudninjas-demo-2024 \
  --lifecycle-configuration '{
    "Rules": [{
      "ID": "ArchiveOldLogs",
      "Status": "Enabled",
      "Filter": {"Prefix": "logs/"},
      "Transitions": [{
        "Days": 90,
        "StorageClass": "GLACIER"
      }]
    }]
  }'

# Check bucket ACL ownership controls
aws s3api get-bucket-ownership-controls --bucket my-cloudninjas-demo-2024

Summary

You now have a working foundation in AWS S3 — covering bucket creation across regions, file operations with both s3 and s3api CLI interfaces, versioning, encryption, and access control with bucket policies. You also know the key exam traps: ARN scoping for ListBucket vs GetObject, the irreversibility of versioning, and when to use pre-signed URLs vs bucket policies.

Key takeaways:

• Bucket names are globally unique; LocationConstraint is required for all regions except us-east-1
• Block Public Access is enabled by default — disable it only when you explicitly need public access
• Bucket policies are resource-based; IAM policies are identity-based — both must allow access for cross-account scenarios
• Always scope s3:ListBucket to the bucket ARN and object actions to bucket/*
• Versioning, lifecycle rules, and encryption should be standard practice on any production bucket

Next steps: Explore S3 Object Lock (WORM compliance), S3 Replication with Replication Time Control (RTC), and S3 Event Notifications with Lambda. For a complete SAA-C03 study path, visit the CloudNinjas AWS Solutions Architect Associate Cert Guide.