Chapter 3 — Storage (S3)

Day 1 — Buckets, Objects, and Versioning

1. Concept Primer

S3 objects are addressed by bucket + key (there are no real "folders" — prefixes just look like paths). Versioning, once enabled on a bucket, keeps every prior copy of an object instead of overwriting it, and deletes become "delete markers" rather than true removal.

2. Hands-on Exercise

Create a bucket, enable versioning, upload the same key twice, and list the version history.

3. Exact Commands

floci start && eval $(floci env)

aws s3 mb s3://versioned-bucket
aws s3api put-bucket-versioning \
  --bucket versioned-bucket --versioning-configuration Status=Enabled

echo "version one" > file.txt
aws s3 cp file.txt s3://versioned-bucket/notes.txt

echo "version two" > file.txt
aws s3 cp file.txt s3://versioned-bucket/notes.txt

aws s3api list-object-versions --bucket versioned-bucket

# Delete and see the delete marker appear rather than true removal
aws s3 rm s3://versioned-bucket/notes.txt
aws s3api list-object-versions --bucket versioned-bucket

4. Gotchas

• S3 is one of Floci's most fully-supported services (real object storage semantics) — a good chapter to trust output at face value.
• aws s3 rm on a versioned bucket doesn't delete data — it adds a delete marker. To truly remove a version you need aws s3api delete-object --version-id <id>.

5. Self-Check

After enabling versioning and deleting an object, why does list-object-versions still show the original content available?

---

Day 2 — Bucket Policies and Presigned URLs

1. Concept Primer

Bucket policies are resource-based (attached to the bucket, listing who can do what), distinct from IAM identity-based policies (attached to a user/role). Presigned URLs let you grant time-limited access to a private object without changing any policy at all — the permission is embedded in a signed query string.

2. Hands-on Exercise

Generate a presigned URL for a private object and fetch it with plain curl.

3. Exact Commands

eval $(floci env)

aws s3 mb s3://private-bucket
echo "secret contents" > secret.txt
aws s3 cp secret.txt s3://private-bucket/secret.txt

URL=$(aws s3 presign s3://private-bucket/secret.txt --expires-in 300)
echo "$URL"

curl "$URL"

4. Gotchas

• Presigned URLs generated against Floci point at http://localhost:4566/... — they will not work if copied into a browser on a different machine, since the emulator only listens locally.
• Expiry is enforced by signature validation, not a background timer — after 300 seconds the same curl call will return a signature-expired error.

5. Self-Check

What's actually embedded in a presigned URL that grants access — a database permission entry, or something computed from your credentials?