S3
Amazon S3 is object storage: files of any size, stored in named buckets and read back by key. The platform uses it for infrastructure state, audit evidence, build artifacts, the web frontend and the data lake.
What it does
A bucket is a container with a globally unique name; an object is a file inside it, addressed by a key such as flow-logs/2026/09/19/file.gz. Versioning keeps every overwrite and deletion as a recoverable version. Lifecycle rules move older objects to cheaper storage classes or expire them. A bucket policy controls who may read or write, and can require TLS. Block Public Access prevents a bucket from ever being made public, and can be set for a whole account. Objects are encrypted at rest with SSE-S3 (keys S3 manages) or SSE-KMS (a key in KMS).
How BuiltForProd uses it
| Bucket | Account | Purpose | Encryption and retention |
|---|---|---|---|
acme-use1-root-tfstate | core-root, us-east-1 | Terraform state for all three infrastructure repositories, one key per unit, with S3 native locking | SSE-KMS; versioning; noncurrent versions expire after 90 days; TLS 1.2 or higher enforced; prevent_destroy |
acme-usw2-audit-logs | core-audit | CloudTrail, AWS Config snapshots and VPC Flow Logs from every account | Dedicated KMS key; versioning; Standard-IA after 90 days, Glacier after 365; current objects never deleted |
| Conformance-pack bucket | core-root | Templates for the organization conformance packs | Created by modules/aws-config with public access blocked and versioning |
acme-usw2-artifacts-shared | core-artifacts | Shared build artifacts, one prefix per application, readable by all plat-* accounts | SSE-S3, because AWS-managed KMS keys cannot be shared across accounts |
| Frontend bucket | plat-*, web application blueprint | The React single-page application, served only through CloudFront with Origin Access Control | SSE-S3; versioning |
<prefix>-raw-data, -processed-data, -curated-data | plat-*, data blueprint | The zoned data lake catalogued in Glue and governed by Lake Formation | SSE-KMS; versioning with 30-day noncurrent retention; Standard-IA after 90 days, Glacier after 180; bucket policy denies direct access except to Lake Formation, the Glue role and administrators |
Three controls apply everywhere. The account baseline sets the account-level public access block in every account except core-public, and the guardrails SCP denies removing it. The state and audit bucket policies reject requests that are not TLS 1.2 or higher. Every bucket has versioning, so a bad write or deletion is recoverable.
Two automations watch S3 specifically. A Security Hub finding about a public bucket triggers the SSM Automation document AWS-DisableS3BucketPublicReadWrite from core-security, with core-public excluded. The organization CloudTrail records S3 data events for the audit bucket itself, so every read of the evidence is itself evidence.
Every workload VPC has a free S3 gateway endpoint on its route tables, which keeps Glue, data-lake and image-layer traffic off the NAT and Transit Gateway path.
Terms you will see
| Term | Meaning |
|---|---|
| Bucket policy | A JSON policy on the bucket that allows or denies principals and conditions. |
| Block Public Access | A setting, per bucket or per account, that makes public access impossible. |
| Versioning | Keeping every version of an object rather than overwriting it. |
| Lifecycle rule | An automatic transition to Standard-IA or Glacier, or an expiry, by age. |
| Noncurrent version | An older version kept by versioning; expired after 30 or 90 days here. |
| Gateway endpoint | A route-table entry that sends S3 traffic over the AWS network instead of the internet. |
| Origin Access Control | The CloudFront mechanism that lets only the distribution read a private bucket. |
Where to read more
- AWS Baseline overview for the state and audit buckets in context.
- Data and ETL Blueprint overview for the data lake.
- CloudFront for how the frontend bucket is served.