Amazon S3 Security, Performance and Infrastructure-as-Code Best Practices Explained

A technical guide covering Amazon S3 security, cost optimisation, and infrastructure-as-code using Terraform has been published as the second part of a two-part series. Since April 2023, all new S3 buckets have Block Public Access enabled by default, and since January 2023, all new objects are encrypted by default using SSE-S3 with AES-256. The guide recommends using SSE-KMS with a dedicated customer-managed key per sensitive bucket to enable auditing via AWS CloudTrail and enforce separation of responsibilities. For cost management, lifecycle policies can automatically transition objects across storage classes, while S3 Intelligent-Tiering handles unpredictable access patterns with no retrieval fees. The article also covers data protection features such as versioning, Object Lock in Compliance mode, and MFA Delete to guard against accidental or malicious deletion.