Skip to main content
provisioning · aws

S3 Object Storage

category
Storage

What does zop.dev create for S3 Object Storage?

zop.dev provisions S3 buckets with public access blocked, encryption enabled and versioning configured. Those 3 defaults exist to prevent the 2 most common S3 incidents: accidental public exposure of data, and an overwrite or delete that turns out to be unrecoverable.

Module backing S3 Object Storage.
Field Value
Cloudaws

Amazon S3 provides durable object storage for application assets, backups, and logs. zop.dev provisions encrypted, versioned buckets so data is protected by default.

Buckets with KMS encryption and versioning on

S3 bucket with KMS server-side encryption and versioning enabled.

Bucket name, with secure defaults preset

Terminal window
Bucket name; KMS SSE and versioning are on by default.

Object storage has no GCP or Azure equivalent

The object-storage module exists for AWS only. There is no GCP or Azure equivalent module.

The defaults exist because of specific failures

Public access block on. S3 bucket exposure remains one of the most common cloud data incidents, and it almost never happens deliberately; it happens through an ACL or policy edit whose blast radius nobody checked. The account-level and bucket-level blocks make that edit fail rather than succeed silently.

Versioning on. An overwrite or delete without versioning is unrecoverable. With it, both are undoable. This is the setting people turn off to save money and regret exactly once.

Encryption at rest. Free, and required by most compliance frameworks.

Versioning changes what storage costs

This is the tradeoff to understand up front: with versioning enabled, deleting an object does not free its storage. It writes a delete marker and retains every previous version, billing for all of them indefinitely.

A bucket with heavy overwrite traffic and no lifecycle policy grows without limit while appearing to hold a constant number of objects. The fix is a lifecycle rule expiring noncurrent versions after a retention period you actually need, usually 30 to 90 days.

Lifecycle is where the savings are

Standard storage is the most expensive tier and the default for everything. For data with a predictable access pattern, lifecycle transitions to Infrequent Access and then Glacier cut the rate substantially without changing how the bucket is used.

Intelligent-Tiering does it automatically for unpredictable patterns, at a small per-object monitoring charge that is worth it above roughly 128 KB per object and not below.

Naming is permanent

Bucket names are globally unique across all AWS accounts and cannot be changed. Renaming means creating a new bucket and copying, which for large buckets is a project rather than a task.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·