AWS S3 Bucket Tutorial: Create a Bucket and Upload Objects

Amazon S3 stores files as objects inside buckets. A bucket name must be unique among existing S3 bucket names, and you choose the Region where a general-purpose bucket is created. New S3 buckets block public access by default, which is the right starting point for this tutorial.

In this guide, we'll create a bucket named demo-glcoct14-bucket in the console, upload notes/hello.txt, and see why the plain object URL returns 403 Forbidden when the request is anonymous. We'll then use the AWS CLI to list and download the same object with authenticated credentials, and generate a short-lived presigned URL when someone needs temporary browser access without making the bucket public.

Key takeaways

• A bucket is a container; an object is a file plus metadata, identified by an object key (a path-like string such as notes/hello.txt).
• Modern defaults favor Bucket owner enforced (ACLs disabled), Block Public Access enabled, and SSE-S3 encryption on new uploads without extra configuration.
• The object URL in the console is not a public link for anonymous users. Applications use IAM-authorized requests; for temporary browser access, use a presigned URL.
• All new S3 uploads are automatically encrypted at rest with SSE-S3 by default. This tutorial does not configure a customer-managed KMS key.
• S3 charges for storage, requests, and data transfer. Empty the bucket and delete it when you finish testing.

Buckets and objects

Console or AWS CLI
             ↓
S3 bucket (Region)
             ↓
Object key notes/hello.txt
             ↓
Object bytes + metadata

What you need

Step 1: Create a general-purpose S3 bucket

Open Amazon S3 → Buckets → Create bucket. Create a standard general-purpose S3 bucket with a unique name and Region. Keep Bucket Versioning disabled for this first walkthrough.

For a new general-purpose bucket, keep the modern S3 defaults:

• Object Ownership: Bucket owner enforced (ACLs disabled)
• Block Public Access: enabled
• Default encryption: S3 automatically encrypts new uploads with SSE-S3

You do not need to make the bucket public just to upload or download files with IAM credentials.

Choose Create bucket. Confirm the new bucket appears in the Buckets list for your Region.

Step 2: Upload an object

Open the bucket, choose Create folder, and name the folder notes. Open the notes/ folder, then choose Upload.

Use Add files (or drag and drop) to upload a small text file named hello.txt. With the file inside the notes/ folder, the full object key is notes/hello.txt.

Choose Upload and wait until the transfer completes.

Step 3: Review the object and public access

Open notes/hello.txt on the object overview page. Note the size and content type.

Under Permissions → Block public access, confirm Block all public access is enabled.

If you open the object URL in a browser without signing in, S3 returns 403 Forbidden. That is expected: the request is anonymous and the object has not been granted public read access. Block Public Access prevents you from accidentally creating such public access.

Applications access private objects with IAM authorization. For temporary browser access, use a presigned URL; for private network routing from a VPC, you can also use an S3 VPC endpoint (still subject to IAM).

Step 4: Verify with the AWS CLI

The commands below assume a configured AWS CLI v2 in the same account as the bucket. If you still need install steps or credential setup, follow the AWS CLI tutorial first.

From a workstation with credentials for the same account, set the Region and bucket name:

export AWS_DEFAULT_REGION=ap-south-1
export BUCKET_NAME=demo-glcoct14-bucket

List objects under the notes/ prefix:

aws s3 ls "s3://${BUCKET_NAME}/notes/"

Sample output:

2026-10-14 15:59:31         23 hello.txt

The size column is in bytes. The date reflects when the object was stored.

Download the object to the current directory:

aws s3 cp "s3://${BUCKET_NAME}/notes/hello.txt" ./hello-downloaded.txt

aws s3 cp prints the source and destination when the copy succeeds.

Read the file to confirm the content:

cat ./hello-downloaded.txt

Sample output:

hello-from-s3-tutorial

Step 5: Create a temporary download link

A private S3 object does not need to be made public just because someone needs to download it. You can create a time-limited presigned URL instead.

Generate a URL that expires in five minutes (300 seconds):

aws s3 presign "s3://${BUCKET_NAME}/notes/hello.txt" --expires-in 300

Sample output (your URL will differ; do not share presigned URLs that contain live credentials):

https://demo-glcoct14-bucket.s3.ap-south-1.amazonaws.com/notes/hello.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...&X-Amz-Expires=300&X-Amz-Signature=...

Open the URL in a browser before it expires. The private object should download successfully while the signature is valid. After expiration, anonymous access stops working again.

Clean up

In the console:

1. Open the bucket, select notes/hello.txt, and delete the object.
2. Return to Buckets, select the bucket, and choose Delete.

Or empty and delete from the CLI:

aws s3 rm "s3://${BUCKET_NAME}" --recursive

When the bucket is empty, delete it:

aws s3api delete-bucket --bucket "${BUCKET_NAME}" --region "${AWS_DEFAULT_REGION}"

Troubleshooting

Summary

Amazon S3 general-purpose buckets hold objects keyed by paths such as notes/hello.txt. The console walkthrough used modern defaults: bucket owner enforced ownership, Block Public Access, and automatic SSE-S3 on uploads. Anonymous object URLs return 403; IAM credentials, presigned URLs, and authorized private connectivity handle real access.

If you need to publish a website or public static files, use a dedicated hosting setup instead of simply opening a general-purpose bucket to everyone — for example host a static website on AWS Amplify. For infrastructure-as-code storage, see configure an S3 bucket as a Terraform backend.

References

• What is Amazon S3?
• Creating a bucket
• Blocking public access to your Amazon S3 storage
• Sharing objects with presigned URLs
• Amazon S3 pricing