S3 Storage Classes, Object Lock, Replication, and Access Paths
Key Takeaways
- S3 Intelligent-Tiering moves objects to Infrequent Access after 30 days with no access and to Archive Instant Access after 90 days, with no retrieval fees in those millisecond tiers; objects smaller than 128 KB stay in Frequent Access.
- S3 Object Lock is versioning-dependent WORM storage: compliance mode cannot be shortened even by the account root user, while governance mode can be bypassed with s3:BypassGovernanceRetention.
- Live Cross-Region Replication and Same-Region Replication copy new objects only; S3 Batch Replication is the on-demand path for existing objects, failed replications, and replicas of replicas.
- An S3 Multi-Region Access Point is a global routing hostname that uses AWS Global Accelerator; it does not copy data, so failover still needs Cross-Region Replication, usually bidirectional with replica modification sync.
- S3 Transfer Acceleration speeds long-distance transfers into a general purpose bucket and is not a content delivery network cache; Requester Pays shifts request and download charges to the caller and disallows anonymous access.
Why object storage shows up as a design problem
Independent SAP-C02 study material by OpenExamPrep treats Amazon Simple Storage Service (Amazon S3) as a professional design surface, not a trivia list of class names. Exam stems describe a global media library, a regulated archive, or a multi-Region product catalog, then ask which combination of storage class, lifecycle, lock, replication, encryption, and access path meets durability, latency, and cost together. S3 is object storage: the unit of work is an object (a mezzanine file, a rendition, a backup blob, a lake partition). It scales without provisioning a file system, and per-request latency is higher than Amazon Elastic Block Store (Amazon EBS) or a network file system. Do not point a POSIX editor that needs byte-range locks at S3 and expect file-share behavior.
Every new object upload is encrypted at rest. Since 5 January 2023, server-side encryption with Amazon S3 managed keys (SSE-S3) is the default for every general purpose bucket. The exam still asks which class, which key model, and which replication topology, because default encryption does not choose those for you.
Storage classes you must discriminate
AWS documents classes for frequent access, unknown access, infrequent access, and archive. S3 Standard (STANDARD) is the default multi-Availability Zone (AZ) class for data read more than once a month with millisecond access. S3 Express One Zone (EXPRESS_ONEZONE) is a directory-bucket class built for consistent single-digit millisecond access in a single AZ, with lower request latency than S3 Standard; it is not a multi-AZ catalog. Reduced Redundancy Storage still appears in docs; AWS recommends against it because S3 Standard is more cost-effective.
S3 Intelligent-Tiering is the class for unknown, changing, or unpredictable access. S3 Standard-IA and S3 One Zone-IA keep millisecond GET with a retrieval fee, a 30-day minimum storage duration, and a 128 KB minimum billable object size. S3 Glacier Instant Retrieval is millisecond archive with a 90-day minimum. S3 Glacier Flexible Retrieval and S3 Glacier Deep Archive are true archive: you restore before read (minutes to hours, or hours), with 90-day and 180-day minima respectively.
| Class | Designed for | AZs | Minimum duration | How you read it |
|---|---|---|---|---|
| S3 Standard | Frequent access, millisecond | ≥ 3 | None | Real-time |
| S3 Intelligent-Tiering | Unknown or changing access | ≥ 3 | None | Real-time in the automatic tiers |
| S3 Standard-IA | Infrequent, millisecond | ≥ 3 | 30 days | Real-time plus retrieval fee |
| S3 One Zone-IA | Recreatable infrequent copies | 1 | 30 days | Real-time plus retrieval fee |
| S3 Express One Zone | Single-digit millisecond, single AZ | 1 | None | Real-time |
| Glacier Instant Retrieval | Quarterly archive, millisecond | ≥ 3 | 90 days | Real-time plus retrieval fee |
| Glacier Flexible Retrieval | Annual archive | ≥ 3 | 90 days | Restore first |
| Glacier Deep Archive | Less than once a year | ≥ 3 | 180 days | Restore first |
AWS recommends Standard-IA for a primary copy you cannot recreate, and One Zone-IA when you can rebuild the data after an AZ failure or when the objects are Cross-Region Replication (CRR) replicas. One Zone-IA and Express One Zone are not designed to survive loss of their AZ. That is the global-media trap: Express One Zone is the lowest-latency object class, but a worldwide video catalog that must survive an AZ event still belongs in a multi-AZ class, usually Standard or Intelligent-Tiering, with Amazon CloudFront in front of the public HTTP path.
Intelligent-Tiering versus lifecycle
S3 Intelligent-Tiering monitors objects for a small per-object monitoring and automation charge and moves them with no retrieval fees among three low-latency tiers: Frequent Access on upload, Infrequent Access after 30 consecutive days with no access, and Archive Instant Access after 90 consecutive days with no access. Optional asynchronous tiers—Archive Access (Glacier Flexible Retrieval-like performance, default after 90 unused days) and Deep Archive Access (Deep Archive-like, default after 180 unused days)—require RestoreObject before the application can read the object. Objects smaller than 128 KB are not monitored and remain in Frequent Access.
Use Intelligent-Tiering when a streaming platform cannot predict which titles stay hot after premiere week. Use S3 Lifecycle when the policy is known in advance: transition a prefix to Standard-IA after 30 days, then Glacier Instant Retrieval after 90 days, abort incomplete multipart uploads, and expire delete markers. Lifecycle is the right tool for “access logs older than N days become archive.” Intelligent-Tiering is the right tool for “we do not know N.” Transitioning into IA or Glacier classes too early can incur minimum-duration charges; optional Intelligent-Tiering archive tiers can surprise an application that still expects millisecond GET. SAP-C02 rewards matching the uncertainty of access, not picking the cheapest class on the table.
Object Lock and WORM
S3 Object Lock implements write once, read many (WORM) on a versioning-enabled bucket. The lock is per object version. A new PUT with the same key creates a new version; the locked version stays. A simple DELETE (no version ID) returns success and writes a delete marker. A permanent DELETE that names a locked version ID is denied while the retention or legal hold applies.
Compliance mode blocks overwrite or delete by any user, including the account root, until the retain-until-date. You cannot shorten the period or change the mode. AWS documents that deleting the AWS account is the only way to remove compliance-locked objects early. Governance mode lets principals with s3:BypassGovernanceRetention and the x-amz-bypass-governance-retention:true header alter or delete. Use governance to test retention before compliance, or when operations must still break glass. Legal holds have no expiry until someone with s3:PutObjectLegalHold removes them; they stack with retention periods.
Object Lock is the professional control for broker-dealer archives assessed against SEC 17a-4-style WORM needs and for ransomware-resistant media masters. If the source bucket has Object Lock, every destination bucket must as well. The replication role needs s3:GetObjectRetention and s3:GetObjectLegalHold (or a broader s3:Get*). Object Lock does not protect you if an AWS Key Management Service (AWS KMS) key is deleted: ciphertext remains, plaintext does not.
Replication, RTC, and Multi-Region Access Points
Live replication copies new and updated objects asynchronously between buckets in the same account or different accounts, to one or many destinations. It does not copy objects that already existed when you enabled the rule. S3 Batch Replication is the on-demand job for existing objects, objects whose status is FAILED, extra destinations, and replicas of replicas (live replication will not replicate a replica).
Cross-Region Replication (CRR) is for compliance distance, placing copies nearer to users, and feeding compute in a second Region. Same-Region Replication (SRR) is for log aggregation, production-to-test copies, and in-Region duplicates when sovereignty rules forbid leaving a country. You can land replicas in a colder class than the source.
S3 Replication Time Control (S3 RTC) is an SLA that 99.99 percent of new objects replicate within 15 minutes. RTC does not apply to Batch Replication. Enable replica modification sync when two-way replication must copy ACL, tag, or lock metadata both directions—the usual prerequisite for treating Multi-Region failover as a data-plane event.
Amazon S3 Multi-Region Access Points (MRAP) give applications a global hostname. Requests use AWS Global Accelerator to enter the AWS backbone and land on the closest bucket with an active routing status. Failover controls can shift active/passive Regions in minutes for drills. MRAP does not copy bytes. You still configure CRR, usually bidirectional, before you claim a Regional outage is survivable. An item that offers “create an MRAP” with no replication is incomplete. SSE-S3 objects replicate by default. SSE-KMS and dual-layer SSE-KMS (DSSE-KMS) objects do not, unless you enable KMS object replication, name a destination-Region key, and grant decrypt, encrypt, and generate-data-key permissions. Amazon S3 currently treats multi-Region KMS keys as single-Region keys for this purpose.
Encryption, Requester Pays, and Transfer Acceleration traps
Choose SSE-KMS when you need KMS API audit trails, customer managed key policy, or bucket keys to reduce KMS request volume. Choose DSSE-KMS when a control wants two independent encryption layers. Choose SSE-C when the caller must present the key on every request (AWS does not store it). Client-side encryption means the application encrypts before PUT and manages keys itself. In transit, TLS is the baseline.
Requester Pays moves request and download charges to the authenticated caller; the owner still pays storage. Anonymous access is not allowed. Callers must send x-amz-request-payer (or --request-payer). On RestoreObject, the requester pays the request and the owner pays retrieval. Do not enable Requester Pays because you wanted a content delivery network; it is a billing-sharing control for large shared datasets.
S3 Transfer Acceleration uses CloudFront edge locations as ingress to one general purpose bucket over an optimized path. Use it for worldwide uploads or unique large transfers into a centralized bucket. The bucket name must be DNS-compliant and must not contain periods; clients use bucket.s3-accelerate.amazonaws.com. Acceleration is not a cache and is not a substitute for CloudFront on popular GET. If millions of viewers repeatedly download the same rendition, CloudFront is the service. If editors on several continents PUT unique masters into one Region, Transfer Acceleration (or a multi-Region write path plus CRR) is the service.
Global media sketch
A streaming studio stores masters in S3 Standard or Intelligent-Tiering, applies Object Lock governance on legal packages, replicates with CRR and RTC to a second Region, exposes an MRAP to internal tools, and serves public HTTP through CloudFront with origin access control. Class handles cost under unknown viewing, lock handles WORM, replication handles data residency of the bytes, MRAP handles multi-Region API routing, and the CDN handles viewer GET. That is the professional combination SAP-C02 is probing in Domain 2 storage and performance items.
A global media company stores user-generated videos in a single Region. Access after premiere week is unpredictable: some titles stay hot for months, others are never watched again, but editors still expect millisecond GET without a restore step. Retrieval fees on the hot subset would be unacceptable. Which storage design best matches the access pattern?
A broker-dealer must keep trade blotter objects immutable for a fixed retain-until-date. Security wants assurance that no principal in the account, including the root user, can shorten retention or permanently delete a protected version during that window. Which Amazon S3 control meets that WORM requirement?
Internal media tools must read and write a replicated S3 dataset through one global hostname. During a Region impairment the company will fail over in minutes, and writes that landed in the remaining Region must replicate back so both buckets stay in sync, including object tags and lock metadata. Which combination is required?