Storage Bucket
Definition
Buckets do not nest. An object storage account has exactly one level of container, and everything else that looks like structure is a prefix inside an object key. The name has to be unique across the whole provider and must survive being used as a hostname, so S3 allows 3 to 63 characters, lowercase letters, digits, hyphens and dots, and nothing else. A bucket is created in one region and the objects in it live there, which fixes both the latency floor for readers and the legal question of where the data sits. The interesting configuration is all at this level: public access blocking, versioning, lifecycle rules, cross-origin rules, default encryption, access logging and the policy document that says who may do what.
Why It Matters
Because settings are bucket-wide, the bucket is also the blast radius. A single toggle that makes a bucket public exposes every object inside it, including the ones nobody remembered were there, and most published cloud data leaks are exactly that mistake rather than anything more sophisticated. Region choice has a running cost too: readers in Sydney fetching from a bucket in Virginia pay around 200 ms on every uncached request. And the count is limited — S3 allows 100 buckets per account by default — so a design that creates one bucket per customer stops working at customer 101, while one bucket with a key prefix per customer scales without complaint and keeps each storage quota a matter of accounting rather than infrastructure.
How It Works
Creating a bucket registers the name and region and returns an endpoint. Requests address it either in virtual-hosted style, as bucket-name.s3.eu-west-2.amazonaws.com, or in the older path style with the bucket as the first path segment. Browser uploads need a cross-origin rule on the bucket listing the allowed origins, methods and headers, or the request fails before it is ever sent. Lifecycle rules are small declarative statements evaluated daily: abort incomplete multipart uploads after 7 days, expire noncurrent versions after 30, transition objects to a cold class after 90. The bucket policy and the access block sit in front of all of it, and the access block wins when the two disagree.
Real-World Example
99helpers keeps every published file in a regional bucket, with each site living under its own key prefix — so studio-north.99helpers.site maps to keys beginning studio-north/ rather than to a bucket of its own. Public reads are served through a CDN rather than from the bucket directly, and the bucket itself stays closed to the internet. Adding a customer adds a prefix, not infrastructure.
Common Mistakes
- ✕Putting uppercase letters or underscores in the bucket name — the virtual-hosted hostname then breaks, and with a dot in the name the TLS certificate stops matching
- ✕Flipping a bucket to public to fix one broken link, exposing every other object in it at the same time
- ✕Assuming cross-origin rules are inherited from somewhere — they are per-bucket, and a missing rule looks like a network error in the browser console
- ✕Creating a bucket per customer or per project until the account limit is reached, when key prefixes would have done the same job
Related Terms
Object Storage
Object storage keeps each file as a self-contained object — its bytes, its metadata and a key that names it — inside a flat container reached over HTTP. There is no directory tree and no file handle to open, seek and write.
Presigned URL
A presigned URL is a link to a private stored object that carries its own authorisation in the query string. Anyone holding the link can perform the one operation it was signed for, on the one object it names, until it expires.
Storage Quota
A storage quota is the total volume of data your account may hold at any one moment. It is a standing measurement of what sits on disk, and downloading a file does not change it.
Multipart Upload
Multipart upload is the object-storage protocol, originally from Amazon S3 and now copied widely, for sending one large object as numbered parts that share an upload ID. A final completion call lists every part number with its ETag and turns the parts into a single object.
CDN
A content delivery network: a set of servers spread across the world that keep copies of your files and answer each visitor from somewhere close to them. It is the service; the machines it runs on are its edge network.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →