This guide shows how to create a private Amazon S3 general purpose bucket, upload a test object, verify it, and clean up. You can use the AWS Management Console or the AWS CLI. S3 encrypts new objects by default, and new buckets keep public access blocked unless you deliberately change those settings.

An S3 bucket is a container in one AWS Region. It holds objects, each identified by a key such as reports/2026/summary.csv. The slashes in a key act as prefixes that the console displays like folders; they are not separate folders in the bucket. For a broader introduction, see AWS's Amazon S3 overview.

Before you create a bucket

Use an AWS account where you are authorized to create and manage the bucket. If you are using the CLI, configure it for the intended account and Region first. You can check the active account with aws sts get-caller-identity. Do not use root account credentials for routine work.

This guide covers general purpose buckets, the standard choice for most S3 workloads. S3 also has directory buckets for S3 Express One Zone; they have different naming, endpoints, and creation steps. See AWS's general purpose bucket creation guide for the bucket types and current console workflow.

Choose a bucket name and Region

Choose the Region where the data should reside. Consider where the application and users run, data residency requirements, and the cost of storage and data transfer. The bucket name and Region are permanent choices: S3 does not let you change either after creation. AWS describes the general purpose bucket naming rules and namespaces.

Choose a shared or account regional namespace

For a shared global namespace, the name must be unique among AWS accounts in its AWS partition. If you later delete a bucket in this namespace, another account may be able to claim its name. AWS also offers an account regional namespace: only your account can create names in that reserved namespace. A name in this namespace follows the format your-prefix-123456789012-us-west-2-an, using your 12-digit account ID and the bucket's Region. Both options create general purpose buckets and support the same S3 features. AWS recommends the account regional namespace when you want assurance that another account cannot create the same bucket name.

General purpose bucket names are 3–63 characters and use lowercase letters, numbers, periods, and hyphens. They must start and end with a letter or number; names cannot have adjacent periods or look like an IP address. Avoid putting sensitive information in a name because bucket names can appear in object URLs. The naming-rules page lists reserved prefixes and suffixes and the complete rules.

Create the bucket in the S3 console

  1. Sign in to the Amazon S3 console. In the top navigation, choose the Region where the bucket will live.
  2. In the left navigation, choose General purpose buckets, then choose Create bucket.
  3. Choose the bucket namespace and enter a name that follows its naming rules. Review the name and Region carefully before proceeding; neither can be changed later.
  4. Under Object Ownership, keep Bucket owner enforced. This default disables ACLs and makes policies the way to control access.
  5. Under Block Public Access settings for this bucket, leave all four settings enabled: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets. AWS applies the most restrictive settings across the organization, account, and bucket.
  6. Bucket Versioning is optional and off by default. Leave it off for a short-lived test bucket unless you want to recover overwritten or deleted objects. If you enable it, account for the extra stored versions and their cost.
  7. Leave Default encryption set to SSE-S3 for the usual starting setup. S3 automatically encrypts all new objects with SSE-S3 at no additional cost. Choose SSE-KMS only when your key-management or compliance requirements call for it; KMS permissions, request quotas, and charges then apply. The KMS key must be in the bucket's Region. See AWS KMS pricing.
  8. Optionally add tags for ownership or cost allocation, then choose Create bucket.

These defaults create a private bucket. Block Public Access prevents public access granted through bucket policies or ACLs; it does not grant access to a signed-in user or application. Keep the settings enabled for this exercise. AWS documents the four Block Public Access controls and S3 default encryption.

Create the bucket with the AWS CLI

Use one of these commands instead of the console's create steps. Replace the example bucket name and Region with your own values. For a bucket in us-east-1, omit --create-bucket-configuration:

aws s3api create-bucket \
  --bucket YOUR_BUCKET_NAME \
  --region us-east-1

For any other Region, supply the same Region as both the CLI Region and LocationConstraint. This exception matters: setting --region alone does not place a general purpose bucket outside us-east-1 in the Region you intended.

aws s3api create-bucket \
  --bucket YOUR_BUCKET_NAME \
  --region YOUR_REGION \
  --create-bucket-configuration LocationConstraint=YOUR_REGION

For example, replace YOUR_REGION with eu-west-1 in both places to create the bucket in Europe (Ireland). To use the account regional namespace from a recent AWS CLI version, use a name with your account ID and Region suffix and add --bucket-namespace account-regional:

aws s3api create-bucket \
  --bucket my-project-data-123456789012-us-west-2-an \
  --region us-west-2 \
  --create-bucket-configuration LocationConstraint=us-west-2 \
  --bucket-namespace account-regional

Replace the example account ID and name prefix with your own. The active CLI credentials must belong to that account. See the AWS CLI create-bucket reference for current command options, including the us-east-1 exception and account regional namespace flag.

Give the right principal access

Creating a private bucket does not automatically let your application read or write it. Use the appropriate IAM role or user and grant only the actions needed for the task, scoped to this bucket or its object keys. For this walkthrough, creation needs s3:CreateBucket; uploads, listings, downloads, and deletion use actions such as s3:PutObject, s3:ListBucket, s3:GetObject, s3:DeleteObject, and s3:DeleteBucket for removing the bucket. Permanently deleting a version also requires s3:DeleteObjectVersion. An AWS administrator may need to provide the permissions required by your console or account policies. Avoid adding broad S3 permissions just to get past an access error.

With the default Bucket owner enforced setting, ACLs are disabled, so do not add ACL headers to uploads. Access is managed with IAM and bucket policies. Encryption and access are separate: SSE-S3 or SSE-KMS protects stored data but does not grant a principal permission to read it. For policy examples and how to scope bucket listing separately from object access, read our Amazon S3 access management guide.

Upload a test object

To upload with the console, open the bucket, choose Upload, add a file, and choose Upload in the upload window. To use the CLI, create a small local text file, then replace YOUR_BUCKET_NAME with the bucket you created and YOUR_REGION with its Region:

printf 'Hello from Amazon S3\n' > hello-s3.txt

aws s3 cp ./hello-s3.txt s3://YOUR_BUCKET_NAME/intro/hello-s3.txt \
  --region YOUR_REGION

The key in this example is intro/hello-s3.txt. The console displays intro like a folder, but it is a prefix within the object's key.

Unless you choose another storage class for an upload, S3 stores the object in S3 Standard. You can use an S3 Lifecycle rule later to move eligible objects to another class or expire them according to your retention policy. See AWS's storage class reference.

Verify the uploaded object

List the prefix and download the object to confirm that it can be read:

aws s3 ls s3://YOUR_BUCKET_NAME/intro/ --region YOUR_REGION

aws s3 cp s3://YOUR_BUCKET_NAME/intro/hello-s3.txt ./hello-s3-downloaded.txt \
  --region YOUR_REGION

Compare hello-s3-downloaded.txt with the file you uploaded. You can also open the bucket in the S3 console and confirm that the object appears under the intro prefix. After a successful upload, a later read or list request to that same bucket immediately sees the object. S3 provides this strong read-after-write consistency in every AWS Region; this does not copy the object to another Region. See AWS's S3 consistency model and console upload steps.

Clean up the test object and bucket

If you created an unversioned bucket for this test and have no other objects in it, remove the test object and then the empty bucket:

aws s3 rm s3://YOUR_BUCKET_NAME/intro/hello-s3.txt --region YOUR_REGION
aws s3 rb s3://YOUR_BUCKET_NAME --region YOUR_REGION

Deleting an object from a versioning-enabled bucket normally adds a delete marker and leaves its earlier versions stored. Those full object versions continue to incur storage charges, and aws s3 rb --force does not remove them. To delete a versioned bucket, permanently remove every object version and delete marker first, following AWS's bucket deletion and emptying instructions. Deleting a bucket in the shared global namespace can also let another account reuse its name, so keep a bucket whose name you need to retain.

Lifecycle expiration also depends on versioning. In an unversioned bucket, expiration deletes an object. In a versioned bucket, expiration of a current object creates a delete marker; it does not remove the older object versions. If your retention rule must permanently remove those versions, add a noncurrent-version expiration action. See AWS's lifecycle rule behavior by versioning state.

S3 costs depend on the data stored, requests, retrieval, and data transfer. SSE-KMS can add AWS KMS charges; versioning stores and bills each full object version. Check the current Amazon S3 pricing for your Region and use case. If you expect to retain data in lower-cost storage classes, see our guide to choosing an S3 storage class and compare retrieval and minimum-duration costs first.

FAQs

Can I change a bucket name or Region after creation?

No. S3 does not let you change a general purpose bucket's name or Region. If you need a different name or Region, create a new bucket and move the objects using a planned migration.

Should I enable versioning on a new bucket?

Enable it when you need to recover from accidental overwrites or deletes. Versioning is disabled by default; each retained version is a full object and incurs storage charges. A normal delete in a versioned bucket adds a delete marker instead of permanently removing earlier versions. If you enable versioning for the first time, AWS recommends waiting 15 minutes before writing or deleting objects while the setting propagates, as described in its versioning guide.

Do I need to make my bucket public to use S3?

No. For private application data, keep all Block Public Access settings enabled and grant the required access to a specific IAM role or user. A public bucket is not a general requirement for storing or retrieving S3 objects.