S3 Object Storage: What It Is For and When to Choose It Over a Disk

A site grows, and one day the server's disk is full of things that have no business being there: last year's backups, thousands of images uploaded by visitors, exports nobody opens any more. The reflex is to buy a bigger disk. Sometimes that is the right answer. Often, those files would be better off in object storage, meaning "buckets" you reach through the S3 protocol.

Here is what it is, what it is for, and when to do without it.

A bucket, objects, a key

In object storage you do not mount a disk. You send objects into a bucket (a named container). An object is a file with a little information attached (size, date, type), identified by a key, for example backups/2026-11/site.tar.gz.

Two consequences worth knowing:

• There is no real directory tree. The "folders" your tools show are only prefixes in the key name (AWS documentation on prefixes).
• You do not edit an object in place: you upload it again, whole. That is why object storage suits files you write, read and replace, but not a database or a file system that changes all the time.

S3 started as an Amazon service, but its protocol became a standard that many hosts and programs speak. People call a service "S3-compatible" when a tool written for S3 works with it after you change the address (the "endpoint") and the access keys.

Four uses where object storage is the right choice

1. The off-site copy of your backups. This is use number one. The 3-2-1 rule asks for three copies, on two media, one of them elsewhere. A bucket is an "elsewhere" that is easy to plug in: rclone, Restic, Veeam and cPanel backups can all write to one. Our article on the 3-2-1 backup strategy covers the rest of the rule.

2. Files that pile up. Product images, attachments, exports, logs. Moving them off the server's disk makes the machine's own backups lighter and avoids the full disk on a Friday evening. For heavy or popular media, also read our articles on hosting high-traffic media and on video and streaming.

3. Archives. Invoices, documents kept for legal reasons, old logs: files you keep for a long time and rarely read. Some storage services offer cheaper classes for this.

4. Application data. Files uploaded by the users of a web application go through an S3 SDK (PHP, Python, Node.js, Go, Java…) instead of being written to the local disk. The application can then run on several servers without sharing a disk.

Three protections to understand before you start

A bucket is not protected just because it is "in the cloud". Three settings make the difference.

• Limited access keys. One key per tool or server, restricted to the one bucket it needs, read-only when it does not have to write. If a server is compromised, you revoke its key and nothing else.
• Versioning. It keeps earlier versions of an object: a file replaced or deleted by mistake can be recovered. Each version takes up space, so it counts in the space used (AWS documentation).
• Object Lock. It makes an object impossible to modify or delete for the period you choose, on a "write once, read many" model (AWS documentation). For backups it is the best answer to ransomware: until the period is over, an attacker who got hold of your credentials cannot erase the locked copy (check the retention mode your provider offers, as some modes can be bypassed by an authorised account). The simplest approach is to turn it on when you create the bucket, before sending the first backups.

One last habit: a copy that has never been restored is not a backup. Try reading a file back from the bucket on day one, then regularly.

When not to use object storage

• For a production database. MySQL or PostgreSQL expect a fast disk that accepts small writes. Back the database up to the bucket; do not put it in it.
• For a WordPress site's code. The site's files must stay on the hosting disk; however, plugins can send the media library to S3 storage.
• For a share mounted like a network drive. S3 is not a file system. If your software expects a shared folder, a disk or an NFS share is still the right tool.

Questions to ask any provider

Before choosing, check these points, with us as anywhere else:

1. The region. Where is the data? If you handle personal data, check with your data protection officer what your obligations require.
2. What is billed on top of the space. Data sent in, data sent out, requests, old versions kept. Read the offer page line by line.
3. What happens past the included space. Does the service stop, or does it carry on with an overage line? Is there a cap that keeps a bill from running away?
4. Are object lock and versioning available, and on which buckets?
5. The exit. Can you get your data back with your usual tools (rclone sync, aws s3 sync) if you leave?
6. The endpoint. S3 requests are signed with the host name, so you generally cannot use your own domain name as the endpoint. To serve files under your domain, go through a CDN or your web server.

At Atlas Hoster

Our S3 object storage is compatible with the standard protocol: rclone, the AWS CLI, s3cmd, Restic, Veeam, Nextcloud, JetBackup and the SDKs of the main languages connect to it. Each offer includes some space; past it, a GB is counted pro rata to the time it is stored. You are told by e-mail at 80 % then 100 % of the included space, and a cap puts your keys in read-only mode if usage runs away. Keys can be limited to one bucket, versioning and object lock are available, and files are encrypted at rest. Buckets, keys and usage are managed from your client area.

For the off-site copy of a VPS or a cPanel account, see also our backups and VPS offers. If you are planning a migration, the guide to migrating a website explains how to move the files without needless downtime.

Frequently asked questions

Does object storage replace a server's disk?

No, it complements it. The system, the code and the databases stay on the server's disk; backups, media, archives and files uploaded by users go into buckets.

What does "S3-compatible" mean?

That the service understands the request protocol originally defined by Amazon S3. Tools and libraries written for S3 work after you change the endpoint address and the access keys.

How do I protect my backups from ransomware?

Send them off the server, into a bucket with limited keys, with object lock turned on for a period at least as long as your retention. A copy the attacker can reach and erase does not protect you.

Can I use my own domain name to access the files?

Not as the S3 endpoint: the request signature includes the host name. Your public files can however be served under your domain by a CDN or by your web server.

Sources

• Amazon S3, Organizing objects using prefixes, S3 Versioning and S3 Object Lock, official documentation.
• Features of our offer: S3 object storage page.