S3 & Storage

Attach IAM roles (instance profile, task role, execution role) so compute gets temporary rotating credentials with no hardcoded keys, and keep application secrets in Secrets Manager or Parameter Store, encrypted with KMS, fetched at runtime and rotated automatically.

Secure S3 with layered controls -- block public access, least-privilege policies, encryption at rest, private VPC endpoints, and logging -- because one wrong permission on a public bucket exposes everything to the whole internet.

EBS is a persistent virtual disk for EC2, and gp3 beats gp2 because you tune IOPS and throughput separately from size and pay less.

Versioning keeps every version and uses a delete marker instead of erasing, so accidental overwrites and deletes are recoverable, while lifecycle rules clean up old versions and MFA Delete guards permanent deletion.

S3 stores files as objects with extreme durability, storage classes trade retrieval speed for cost, and lifecycle policies automatically move and delete objects as they age to cut the bill.