The service always provides buckets as uniquely identifiable containers in which objects are stored and to which access policies and configuration are applied.
The service always allows a user to replace an object in a bucket by writing a new object to the same key, overwriting the previous content unless versioning retains it.
The service can enforce access permissions on an individual object, independently of the permissions applied to the containing bucket. Whether object-level permissions are enabled by default on a new bucket varies by provider.
The service always offers multiple storage classes with differing durability, availability and retrieval latency, and an object may be configured to use a class other than the default.
The service can encrypt an object at rest with a key that the user supplies in each request and that the service does not retain, as distinct from a key referenced from a key management service, so the object can only be read by presenting the same key again.
The service may be configured with a cross-origin resource sharing (CORS) policy on a bucket that determines which web origins a browser is permitted to request objects from.
The service may be configured to disable object-level permissions on a bucket, so that access to every object is governed solely by the bucket-level policy.
The service may be configured to lock an object or a bucket so that its objects cannot be overwritten or deleted until a retention period expires, and the lock itself may be made irrevocable.