S3 protection and recovery
Start with S3, authorization and recovery objectives. Strong consistency is automatic for supported S3 object operations; it does not protect against authorized destructive changes.
Independent controls
Object Ownership and Block Public Access address access configuration. Bucket/resource policies, access points and KMS permissions control approved use. OAC authenticates supported CloudFront origin access; a distribution alone does not make a bucket private.
Versioning retains object versions; a delete marker can hide the current object without erasing prior versions. Lifecycle can still delete retained versions. Object Lock governance/compliance retention and legal holds have distinct removal permissions and consequences—do not experiment with irreversible retention on valuable data.
Replication has source/destination, permission, versioning and operation-specific conditions. It is not an unconditional guarantee of immediate replication or backup of every historic/delete operation.
Sandbox restore exercise
Prerequisites: a private sandbox bucket with versioning, disposable text/object data, least-privilege object/version permissions and a retention/cost plan. Avoid compliance lock for this basic exercise.
- Upload version A with a known checksum, then version B.
- Record version IDs and confirm the current read returns B.
- Delete the current object, inspect versions/delete marker and confirm the ordinary read is hidden.
- Restore the intended version using the documented version workflow; verify checksum and identity.
- Test access from an unauthorized sandbox role; expect denial even though the object exists.
- Review lifecycle before cleanup. Delete only all disposable lab versions and delete markers, then remove the dedicated bucket if appropriate.
For an OAC extension, remove public-read permissions, authorize only the intended distribution and test both CloudFront success and direct-S3 denial. Confirm that shared/personalized content has a safe cache key.
Recovery acceptance
Verify data, permissions, encryption keys and client behavior. If using retention or copies, test from the actual recovery identity and destination account. A replication status or successful GetObject is only one checkpoint.
Budget stored versions, minimum storage durations, retrieval/restore requests, replicated bytes and logging. Copies multiply stored data and may change deletion obligations.