S3
8 articles on S3.
Object tags or prefixes: which access model survives growth
Prefixes decide what a principal can list, tags decide what it can read. Two AWS limits break tag-only designs, and prefix policies run out at about 60 tenants.
Chained AssumeRole sessions stop at one hour, silently
A role that assumes another role gets 3600 seconds, whatever its MaxSessionDuration allows. The exact error, and the batch job that dies at minute 61.
Presigned POST: cap size and type before the upload starts
A presigned PUT signs a URL, not a byte count. A POST policy adds a size range and a content-type condition that S3 enforces while the body arrives.
Presigned URLs expire at seven days. Then what?
Seven days is not a setting: it is how long the SigV4 signing key lives. What happens at that wall, and the three patterns that outlive it.
When two policies allow and the request still fails
S3 returns AccessDenied even when the bucket and IAM policies both allow. Here is the five-gate evaluation order and where the hidden deny sits.
S3 Explorer walkthrough: zero to browsing in 5 minutes
A step-by-step walkthrough of S3 Explorer against a live S3 endpoint: pick a provider, test, browse buckets, inspect metadata, read request metrics.
The real cost of S3: 8 providers compared, egress included
Storage is 20% of your bill. We modelled 8 S3 providers across 4 workloads — backup, app, media, DR — with storage, egress, requests and replication.
Why we started writing about S3
The short version: object storage is everywhere, and most of the advice about it is either outdated or written for a different scale.