Buckets
aws s3 lsLists every bucket in the account.
aws s3 mb s3://my-bucketCreates a new bucket. Bucket names are globally unique across all of AWS, not just your account.
aws s3 rb s3://my-bucketDeletes a bucket. Fails if it isn't empty unless you add --force, which deletes every object in it first.
Listing & Inspecting Objects
aws s3 ls s3://my-bucket/Lists top-level objects and prefixes in a bucket.
aws s3 ls s3://my-bucket/ --recursive --human-readable --summarizeLists every object under a prefix recursively, with human-readable sizes and a total at the end.
Copying & Syncing
aws s3 cp file.txt s3://my-bucket/Uploads a single local file to a bucket.
aws s3 cp s3://my-bucket/file.txt .Downloads a single object to the current directory.
aws s3 sync ./dist s3://my-bucket/Uploads only new or changed files from a local directory, mirroring it to a bucket prefix.
aws s3 sync s3://my-bucket/ ./backup --deleteMirrors a bucket to a local directory and deletes local files that no longer exist in the bucket — the --delete flag makes this destructive on the local side.
Deleting
aws s3 rm s3://my-bucket/file.txtDeletes a single object. Permanent unless the bucket has versioning enabled.
aws s3 rm s3://my-bucket/ --recursiveDeletes every object under a prefix. There is no confirmation prompt — double-check the prefix before running this.
Access & Policy
aws s3api get-bucket-policy --bucket my-bucketShows a bucket's resource policy as JSON.
aws s3api get-public-access-block --bucket my-bucketShows whether S3's account or bucket-level public access blocks are enabled — the setting most responsible for preventing accidental public buckets.
aws s3 presign s3://my-bucket/file.txt --expires-in 3600Generates a time-limited URL granting temporary access to a private object, without changing the bucket's permissions at all.
Public buckets are almost always a mistake
Before making anything public, confirm it's genuinely intended — a bucket policy or ACL exposing customer data or internal artifacts to the internet is one of the most common and most damaging cloud misconfigurations. Leave the account-level public access block enabled unless you have a specific, reviewed reason to disable it.