Object storage
Object storage for static web assets: separate uploads from application servers
Static assets are a natural object-storage workload because each image, document or generated file can be addressed independently. Moving those objects away from a single application server can simplify scaling, but access control and delivery still need deliberate design.
Give assets stable object identifiers
Generate keys from application IDs, content hashes or controlled naming rules. Do not make the web application depend on an administrator’s manually-created folder structure.
Store user-facing filenames and content metadata separately when the original name is not a safe or unique storage identifier.
Keep upload credentials server-side
The browser should not receive a permanent S3 secret. Let the authenticated application upload on the user’s behalf or issue a short-lived presigned upload for one approved key.
Validate file size and content handling at the application layer even when the bytes travel directly to object storage.
Decide how public delivery works
For truly public assets, a CDN or narrowly scoped public-read delivery path can avoid making the entire bucket broadly writable or listable. Private downloads can use application authorization plus presigned URLs.
Storage policy and cache policy are different decisions. A CDN cache does not replace object access controls at the origin.
Handle replacement and cache invalidation
If an asset can change, content-hashed object names make caches easier to reason about because a new version gets a new URL. Reusing one key can leave old bytes in browsers or edge caches.
Define whether deletion should immediately remove an object or leave an older version for recovery.
Back up metadata as well as objects
An application database may map users or records to object keys. Copying the bucket without that mapping can leave a large collection of objects that the application cannot reconnect to records.
Recovery testing should restore both the object dataset and the application metadata that references it.