Amazon S3 for Developers

1import {
2  S3Client, PutObjectCommand, GetObjectCommand,
3  DeleteObjectCommand, CopyObjectCommand, HeadObjectCommand,
4  ListObjectsV2Command,
5} from '@aws-sdk/client-s3';
6
7const s3 = new S3Client({ region: 'us-east-1' });
8
9// ── PUT ───────────────────────────────────────────────────────────────────────
10await s3.send(new PutObjectCommand({
11  Bucket: 'my-bucket',
12  Key: 'uploads/profile/alice.jpg',
13  Body: fileBuffer,
14  ContentType: 'image/jpeg',
15  Metadata: { 'uploaded-by': 'alice', 'source': 'mobile-app' },
16  StorageClass: 'STANDARD_IA',
17  ServerSideEncryption: 'aws:kms',
18  SSEKMSKeyId: 'alias/my-key',
19  Tagging: 'env=prod&team=platform',
20}));
21
22// ── GET ───────────────────────────────────────────────────────────────────────
23const { Body, ContentType, ContentLength } = await s3.send(new GetObjectCommand({
24  Bucket: 'my-bucket',
25  Key: 'uploads/profile/alice.jpg',
26  // Range: 'bytes=0-1023',  // byte-range fetch (first 1 KB)
27}));
28const buffer = Buffer.from(await Body.transformToByteArray());
29
30// ── HEAD (metadata without body) ─────────────────────────────────────────────
31const { ContentLength: size, LastModified, Metadata } = await s3.send(
32  new HeadObjectCommand({ Bucket: 'my-bucket', Key: 'uploads/profile/alice.jpg' })
33);
34
35// ── COPY ─────────────────────────────────────────────────────────────────────
36await s3.send(new CopyObjectCommand({
37  CopySource: 'source-bucket/original/file.txt',
38  Bucket: 'dest-bucket',
39  Key: 'copies/file.txt',
40  StorageClass: 'GLACIER',
41}));
42
43// ── LIST (paginated) ─────────────────────────────────────────────────────────
44let continuationToken;
45do {
46  const { Contents, NextContinuationToken } = await s3.send(
47    new ListObjectsV2Command({
48      Bucket: 'my-bucket',
49      Prefix: 'uploads/',
50      MaxKeys: 1000,
51      ContinuationToken: continuationToken,
52    })
53  );
54  for (const obj of Contents ?? []) {
55    console.log(obj.Key, obj.Size, obj.LastModified);
56  }
57  continuationToken = NextContinuationToken;
58} while (continuationToken);

1import { Upload } from '@aws-sdk/lib-storage';
2import { createReadStream } from 'fs';
3
4// High-level Upload class handles multipart automatically
5const upload = new Upload({
6  client: s3,
7  params: {
8    Bucket: 'my-bucket',
9    Key: 'large-file.zip',
10    Body: createReadStream('/tmp/large-file.zip'),
11    ContentType: 'application/zip',
12  },
13  partSize: 10 * 1024 * 1024,   // 10 MB per part
14  queueSize: 4,                  // 4 concurrent part uploads
15});
16
17upload.on('httpUploadProgress', ({ loaded, total }) => {
18  console.log(`Uploaded ${loaded} / ${total} bytes`);
19});
20
21await upload.done();

1import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
2
3// ── PRE-SIGNED GET (download) ─────────────────────────────────────────────────
4const downloadUrl = await getSignedUrl(s3, new GetObjectCommand({
5  Bucket: 'my-bucket',
6  Key: 'reports/invoice-2024-01.pdf',
7  ResponseContentDisposition: 'attachment; filename="invoice.pdf"',
8}), { expiresIn: 3600 });   // 1 hour
9
10// ── PRE-SIGNED PUT (direct browser upload) ────────────────────────────────────
11const uploadUrl = await getSignedUrl(s3, new PutObjectCommand({
12  Bucket: 'my-bucket',
13  Key: `uploads/${userId}/${filename}`,
14  ContentType: 'image/jpeg',
15}), { expiresIn: 300 });   // 5 minutes
16
17// Client uses uploadUrl with a plain HTTP PUT — no AWS credentials needed
18// fetch(uploadUrl, { method: 'PUT', body: file, headers: { 'Content-Type': 'image/jpeg' } })

1// Lambda triggered by S3 ObjectCreated event
2export async function handler(event) {
3  for (const record of event.Records) {
4    const bucket = record.s3.bucket.name;
5    const key = decodeURIComponent(record.s3.object.key.replace(/\+/g, ' '));
6    const size = record.s3.object.size;
7    const eventName = record.eventName;   // e.g., 'ObjectCreated:Put'
8
9    console.log(`${eventName}: s3://${bucket}/${key} (${size} bytes)`);
10    await processUpload(bucket, key);
11  }
12}

1# List all versions of an object
2aws s3api list-object-versions   --bucket my-bucket   --prefix photos/alice.jpg
3
4# Restore a previous version (copy it to become current)
5aws s3 cp s3://my-bucket/photos/alice.jpg   s3://my-bucket/photos/alice.jpg   --version-id abc123
6
7# Permanently delete a specific version
8aws s3api delete-object   --bucket my-bucket   --key photos/alice.jpg   --version-id abc123

1# Enforce encryption at rest — deny unencrypted PUTs via bucket policy
2aws s3api put-bucket-policy --bucket my-bucket --policy '{
3  "Version": "2012-10-17",
4  "Statement": [{
5    "Sid": "DenyUnencryptedObjectUploads",
6    "Effect": "Deny",
7    "Principal": "*",
8    "Action": "s3:PutObject",
9    "Resource": "arn:aws:s3:::my-bucket/*",
10    "Condition": {
11      "StringNotEquals": {
12        "s3:x-amz-server-side-encryption": "aws:kms"
13      }
14    }
15  }]
16}'
17
18# Enforce HTTPS-only access
19aws s3api put-bucket-policy --bucket my-bucket --policy '{
20  "Statement": [{
21    "Effect": "Deny",
22    "Principal": "*",
23    "Action": "s3:*",
24    "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"],
25    "Condition": { "Bool": { "aws:SecureTransport": "false" } }
26  }]
27}'

1# Block ALL public access on a bucket (recommended default)
2aws s3api put-public-access-block   --bucket my-bucket   --public-access-block-configuration     BlockPublicAcls=true,IgnorePublicAcls=true,    BlockPublicPolicy=true,RestrictPublicBuckets=true

1{
2  "Version": "2012-10-17",
3  "Statement": [{
4    "Sid": "AllowCrossAccountRead",
5    "Effect": "Allow",
6    "Principal": { "AWS": "arn:aws:iam::987654321098:role/DataPipelineRole" },
7    "Action": ["s3:GetObject", "s3:ListBucket"],
8    "Resource": [
9      "arn:aws:s3:::my-data-bucket",
10      "arn:aws:s3:::my-data-bucket/*"
11    ]
12  }]
13}

1{
2  "Rules": [
3    {
4      "ID": "IntelligentTieringAfter30Days",
5      "Status": "Enabled",
6      "Filter": { "Prefix": "logs/" },
7      "Transitions": [
8        { "Days": 30,  "StorageClass": "INTELLIGENT_TIERING" },
9        { "Days": 90,  "StorageClass": "GLACIER" },
10        { "Days": 365, "StorageClass": "DEEP_ARCHIVE" }
11      ],
12      "Expiration": { "Days": 2555 }
13    },
14    {
15      "ID": "CleanupIncompleteMultipartUploads",
16      "Status": "Enabled",
17      "Filter": {},
18      "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
19    },
20    {
21      "ID": "ExpireOldVersions",
22      "Status": "Enabled",
23      "Filter": {},
24      "NoncurrentVersionExpiration": { "NoncurrentDays": 30 },
25      "NoncurrentVersionTransitions": [
26        { "NoncurrentDays": 7, "StorageClass": "STANDARD_IA" }
27      ]
28    }
29  ]
30}

1import { SelectObjectContentCommand } from '@aws-sdk/client-s3';
2
3const response = await s3.send(new SelectObjectContentCommand({
4  Bucket: 'my-bucket',
5  Key: 'data/orders-2024.csv',
6  ExpressionType: 'SQL',
7  Expression: "SELECT * FROM S3Object WHERE status = 'failed' AND amount > 1000",
8  InputSerialization: {
9    CSV: { FileHeaderInfo: 'USE', RecordDelimiter: '\n', FieldDelimiter: ',' },
10    CompressionType: 'GZIP',
11  },
12  OutputSerialization: { CSV: {} },
13}));
14
15// Stream the filtered results
16for await (const event of response.Payload) {
17  if (event.Records?.Payload) {
18    process.stdout.write(Buffer.from(event.Records.Payload));
19  }
20}

1[
2  {
3    "AllowedHeaders": ["*"],
4    "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
5    "AllowedOrigins": ["https://app.example.com"],
6    "ExposeHeaders": ["ETag", "x-amz-request-id"],
7    "MaxAgeSeconds": 3000
8  }
9]

1aws s3api put-bucket-cors   --bucket my-bucket   --cors-configuration file://cors.json

1# Enable Transfer Acceleration
2aws s3api put-bucket-accelerate-configuration   --bucket my-bucket   --accelerate-configuration Status=Enabled
3
4# Upload via accelerated endpoint
5aws s3 cp large-file.zip s3://my-bucket/   --endpoint-url https://my-bucket.s3-accelerate.amazonaws.com