A data-driven breakdown of Amazon S3 for the AWS SAA-C03 Solutions Architect exam, based on analysis of 274 S3-tagged questions from public question banks. Key findings: 102 questions ask for the most cost-effective option, 45 ask for least operational overhead. The guide covers the three dominant question shapes, storage class decision criteria with exact billing minimums, lifecycle rule pitfalls, access control layers (Block Public Access, bucket policies, VPC gateway endpoints, presigned URLs, OAC), encryption options, Object Lock modes, replication, performance numbers, and on-premises data transfer service selection. It also flags post-exam changes: maximum object size raised to 50 TB, S3 Select closed to new customers, new S3 data platform features (Tables, Metadata, Vectors, Files), and the fact that 38% of community-voted answers disagree with the keyed answers in the question bank.
Table of contents
What the exam actually asks about S3Which S3 storage class does the question want?The lifecycle rule that answers 28 questionsWho is allowed to read the bucket?Encryption: four server-side options, one of them already onKeeping data safe: versioning, Object Lock, replicationPerformance answers you can memoriseGetting data in: the on-premises questionsWhat changed after the exam was writtenFAQHow to study S3 for SAA-C03Questions this post answers
What is the difference between S3 Object Lock governance mode and compliance mode?
In governance mode, users with the s3:BypassGovernanceRetention permission can remove the lock, providing protection against accidental deletion. In compliance mode, nobody — including the root user — can shorten the retention period or delete the object until it expires. Compliance mode is the correct choice when a requirement states that not even an administrator can delete the data. Teams designing immutable audit storage weigh these trade-offs on daily.dev.
When should I use a gateway VPC endpoint vs an interface endpoint for S3?
A gateway VPC endpoint adds a route table entry, costs nothing, and keeps S3 traffic on the AWS network — it is the right choice when the goal is preventing internet traversal and all traffic originates inside the VPC. An interface endpoint (PrivateLink) is correct when traffic comes from on-premises over Direct Connect or VPN, or when a private IP inside the VPC is required, but it is billed per hour and per GB. Architects choosing between these options for cost-sensitive VPC designs follow the discussion on daily.dev.
Is S3 Select still available for querying data inside S3 objects?
S3 Select has been closed to new customers since 25 July 2024, and AWS directs new workloads to Amazon Athena. S3 Object Lambda was similarly limited to existing customers from 7 November 2025. Older SAA-C03 exam questions still key S3 Select as the correct answer for running SQL against a single object, so it remains the right exam answer while Athena is the correct production choice. Developers migrating away from S3 Select track Athena adoption news on daily.dev.