Object storage (S3) basics: buckets, access and presigned URLs

Object storage stores files (called objects) in flat containers called buckets, and you read and write them over HTTP through an API. Amazon S3 made it famous, and many services offer S3-compatible APIs, such as Cloudflare R2, Backblaze B2, DigitalOcean Spaces and MinIO (which you can run yourself).

It is ideal for images, videos, documents, backups, logs and static website files.

How it differs from other storage

• Block storage (a disk attached to a server): fast, for operating systems and databases.
• File storage (a shared network drive): folders and file locking.
• Object storage: each object has a key (its name, such as uploads/2026/photo.jpg), its data and some metadata. There are no real folders (slashes are just part of the key). You replace a whole object rather than editing a piece of it. In exchange you get huge scale, high durability and low cost.

Why use it for an app

Keeping user uploads on the application server's disk causes trouble: disks fill, files are lost when a server is replaced, and several servers cannot share them. Putting uploads in object storage makes your servers stateless, and a CDN can serve the files quickly.

The database should store the object key or URL, not the file itself.

Keep buckets private by default

The most common cloud data leak is a public bucket. Rules:

• Turn on the provider's block public access setting for the account and the bucket.
• Make a bucket public only when it truly serves public files, and only that bucket.
• Use bucket policies and IAM to give applications access to specific buckets or prefixes only.
• Never put private data (invoices, IDs, backups) in a public bucket.
• Turn on access logs and alerts for policy changes.

Presigned URLs: private files, safe sharing

A presigned URL is a temporary link that lets someone upload or download one specific object without having your credentials.

Download flow: the user asks your app for a private file, your app checks they are allowed, then generates a link valid for a short time (for example 5 minutes) and redirects them.

Upload flow: instead of sending the file through your server, your app gives the browser a presigned upload URL, and the browser uploads directly to the bucket. This saves your bandwidth and CPU.

Safety tips for uploads:

• Choose the object key on the server side, do not trust the user's file name.
• Limit size and content type in the signed request, and check after upload (see the file upload security article in the web security series).
• Keep expiry short.
• Scan or process untrusted files before showing them to others.

Storage classes and lifecycle

• Standard: for frequently used data.
• Infrequent access and archive classes: much cheaper to store, but with retrieval fees or delays. Good for old backups and logs.
• Lifecycle rules move objects to cheaper classes or delete them after a set time automatically, for example "delete temporary uploads after 7 days".

Versioning and protection

• Versioning keeps old versions, so a bad overwrite or delete can be undone.
• Object lock or immutability stops deletion for a period, which helps against ransomware.
• Replication copies objects to another region for disaster recovery.
• Encryption at rest is usually on by default. You can use your own keys for extra control.

Costs to watch

• Storage per GB per month.
• Requests (reads and writes are billed per number).
• Egress: data leaving the provider can cost the most. A CDN in front reduces it, and some providers (such as Cloudflare R2) do not charge egress fees. Always check current pricing.
• Old versions and incomplete multipart uploads quietly add up, so set lifecycle rules to clean them.

Quick checklist

• Bucket private, block public access on.
• App uses a role with access to only its bucket.
• Presigned URLs with short expiry.
• Keys generated by the server, size and type limited.
• Versioning and lifecycle rules set.
• CDN in front for public files.

Takeaway: use object storage for files instead of server disks, keep buckets private, share through short-lived presigned URLs, let browsers upload directly, and use lifecycle rules and a CDN to control cost.

---

Networking & Cloud series, Part 2 (cloud fundamentals): 4 of 5. Previous: Cloud IAM: least privilege, roles and keeping access keys safe.