Amazon S3 Explained (2026): Storage Classes, Real Prices and Egress

Most S3 bills I get asked to look at are not storage bills. They are request bills, egress bills, or tiny-files-in-Glacier bills. Amazon S3 in 2026 has eight storage classes worth knowing, three specialised bucket types plus a file-system layer that did not exist three years ago, and security defaults that quietly changed underneath everyone. This post explains what S3 is now, what each storage class really costs once you add requests, retrieval and minimum durations, where the newer pieces (Express One Zone, S3 Tables, S3 Vectors, S3 Files) fit, and when Cloudflare R2 or Google Cloud Storage is the better answer. All prices are US East (N. Virginia), pulled from the AWS Price List API file published 15 October 2026, and cross-checked against the S3 pricing page.

What is Amazon S3, and what changed by 2026?

S3 is an object store: you PUT a blob under a key, GET it back by key, and pay for bytes stored, requests, and bytes that leave AWS. Every storage class except One Zone-IA and Express One Zone stores data across at least three Availability Zones and is designed for 99.999999999% durability.

Four behaviour changes matter more than any launch, because older tutorials describe the old world:

• Strong consistency. Since December 2020, a successful write is immediately visible to every subsequent read and list, for free. The old "eventual consistency on overwrite" caveats are history.
• Conditional writes. Since August 2024, PutObject and CompleteMultipartUpload accept If-None-Match, so S3 can refuse to overwrite an existing key. That is what let Terraform drop DynamoDB for state locking, which I covered in Terraform State in 2026.
• Encryption and public access by default. Since 5 January 2023 every new object is encrypted with SSE-S3 at no cost, and you cannot turn that off. Since April 2023, new buckets get Block Public Access on and ACLs disabled, whether you create them in the console, the CLI or CloudFormation.
• SSE-C off by default. In April 2026 S3 disabled customer-provided-key encryption on all new general purpose buckets, and on existing buckets in accounts that had no SSE-C objects. Writes that ask for SSE-C now fail with 403 AccessDenied unless you re-enable it with PutBucketEncryption. If a legacy uploader suddenly broke this year, check this first.

Performance is also better than its reputation. AWS documents at least 3,500 writes and 5,500 reads per second per partitioned prefix, with no limit on prefixes. You will see 503 Slow Down while S3 scales a hot prefix; retries with backoff are part of the contract.

S3 storage classes compared: prices and minimums in 2026

The class is set per object, not per bucket. Here is the US East table, with the fees that decide whether a class is actually cheap.

Storage class	Storage $/GB-month	Retrieval $/GB	PUT per 1,000	GET per 1,000	Min duration	Min billable size	AZs
S3 Standard	0.023 (first 50 TB), 0.022, 0.021 over 500 TB	none	0.005	0.0004	none	none	3+
Intelligent-Tiering	0.023 / 0.0125 / 0.004 by tier, plus $0.0025 per 1,000 objects monitored	none	0.005	0.0004	none	not monitored under 128 KB	3+
Express One Zone	0.11	0.0006 (upload 0.0032)	0.00113	0.00003	none	none	1
Standard-IA	0.0125	0.01	0.01	0.001	30 days	128 KB	3+
One Zone-IA	0.01	0.01	0.01	0.001	30 days	128 KB	1
Glacier Instant Retrieval	0.004	0.03	0.02	0.01	90 days	128 KB	3+
Glacier Flexible Retrieval	0.0036	0.01 standard, bulk free	0.03	restore needed	90 days	40 KB overhead per object	3+
Glacier Deep Archive	0.00099	0.02 standard, 0.0025 bulk	0.05	restore needed	180 days	40 KB overhead per object	3+

Sources: AWS Price List API, AmazonS3 and AmazonS3GlacierDeepArchive offers for us-east-1; minimums and AZ counts from the S3 storage class guide.

Three columns cause most surprises.

Minimum billable size. Standard-IA, One Zone-IA and Glacier Instant Retrieval bill every object as at least 128 KB. A 4 KB thumbnail in Standard-IA costs the same as a 128 KB one, which makes it 32 times more expensive per real byte than the headline rate suggests. Glacier Flexible Retrieval and Deep Archive add 40 KB of metadata per object, 8 KB of it billed at the Standard rate. AWS acknowledged the problem in September 2024 by making new lifecycle rules skip objects under 128 KB by default.

Minimum duration. Delete or overwrite a Glacier Instant Retrieval object after ten days and you still pay for ninety. Build artifacts with a two-week life do not belong in any IA or Glacier class.

Request prices. A PUT into Deep Archive is ten times the price of a PUT into Standard. Archiving a hundred million small objects costs $5,000 in transition requests before you have stored a byte, which is why you pack small files into tar or Parquet before archiving them.

How S3 pricing actually works: requests, retrieval and egress

An S3 invoice has four lines that matter: storage (GB-months), requests (per thousand), retrieval (per GB, for IA and Glacier classes), and data transfer. The fourth is usually the biggest.

Data transfer out to the internet from us-east-1 is $0.09 per GB for the first 10 TB a month, falling to $0.085, $0.07 and $0.05 at higher tiers, after the first 100 GB a month that AWS gives free across all services. Data in is free, and transfer from S3 to CloudFront is free, which is why anything public should sit behind a CDN.

A quick worked example with list prices. Store 10 TB (10,240 GB) in Standard for a month: $235.52. Let users download all of it once: about $912 in egress. Ten million GETs: $4. Ten million PUTs: $50. Egress is the line that hurts. If you are chasing a surprise bill, Why Is My AWS Bill So High? walks through the Cost Explorer usage types that separate these.

Lifecycle rules turn class choice into a policy. A rule I would ship for a versioned logs bucket:

# Written for aws-cli 2.27.7 (JSON checked locally, not run against a live bucket).
# Applies to objects over 128 KB under logs/.
cat > lifecycle.json <<'EOF'
{
  "Rules": [
    {
      "ID": "logs-tiering",
      "Status": "Enabled",
      "Filter": { "And": { "Prefix": "logs/", "ObjectSizeGreaterThan": 131072 } },
      "Transitions": [
        { "Days": 30,  "StorageClass": "STANDARD_IA" },
        { "Days": 90,  "StorageClass": "GLACIER_IR" },
        { "Days": 365, "StorageClass": "DEEP_ARCHIVE" }
      ],
      "Expiration": { "Days": 2555 },
      "NoncurrentVersionExpiration": { "NoncurrentDays": 30 }
    },
    {
      "ID": "abort-stale-multipart",
      "Status": "Enabled",
      "Filter": {},
      "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
    }
  ]
}
EOF

# The 128 KB size filter keeps tiny objects out of classes that bill them as 128 KB.
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-logs-bucket \
  --lifecycle-configuration file://lifecycle.json

aws s3api get-bucket-lifecycle-configuration --bucket my-logs-bucket

The second rule matters: failed multipart uploads leave invisible parts billed at Standard rates until something aborts them.

When is S3 Intelligent-Tiering worth it?

Intelligent-Tiering moves each object between Frequent ($0.023), Infrequent ($0.0125, after 30 days without access) and Archive Instant ($0.004, after 90 days) tiers on its own, with no retrieval fees, per the storage class guide. The price is a monitoring fee of $0.0025 per 1,000 objects a month, and objects under 128 KB are never monitored or moved.

The break-even is simple arithmetic. Moving one object from Frequent to Infrequent saves $0.0105 per GB-month; the fee is $0.0000025 per object-month. Divide one by the other and an object needs to be larger than about 250 KB, and actually go cold, before the savings beat the fee. At the Archive Instant tier the threshold drops to about 140 KB. For multi-megabyte objects with unpredictable access (user uploads, ML datasets), Intelligent-Tiering is close to free money. For hot, small JSON files it is a tax.

My rule: use Intelligent-Tiering as the default class when you do not know the access pattern, use explicit lifecycle rules when you do (logs, backups with a known retention), and never use it for data you will delete within a month.

S3 Express One Zone, S3 Tables, S3 Vectors and S3 Files

AWS has spent three years turning S3 into a family of bucket types, each priced for one problem.

Express One Zone uses directory buckets in a single Availability Zone you choose, for single-digit millisecond access. In April 2025 AWS cut storage by 31% to $0.11 per GB, PUTs by 55% and GETs by 85%. Requests are now far cheaper than Standard, storage is nearly five times dearer, and losing the AZ means losing the data. It fits training data caches, shuffle and scratch space, and anything that is read thousands of times and can be regenerated.

S3 Tables, launched 3 December 2024, are table buckets that store Apache Iceberg tables and run compaction for you. AWS claims up to 3x faster query throughput and 10x more transactions per second than self-managed Iceberg tables. Storage is $0.0265 per GB-month in us-east-1, plus $0.025 per 1,000 objects monitored and compaction fees. If you already run Iceberg on S3 and spend engineer time on compaction jobs, it is worth a test.

S3 Vectors went generally available on 2 December 2025, with up to two billion vectors per index and 10,000 indexes per bucket. Queries take under a second when infrequent and around 100 ms when frequent, so it is a cheap cold tier for embeddings rather than a replacement for a low-latency vector database. Pricing is $0.06 per GB-month, $0.20 per GB uploaded and $2.50 per million queries plus data-processed fees (S3 pricing). Vector Databases in 2026 covers when pgvector is enough instead.

S3 Files, announced 7 April 2026, mounts a general purpose bucket as a shared file system built on Amazon EFS, with the same data still reachable through the S3 API. The price list shows $0.30 per GB-month for data held in the file system's high-performance tier, so treat it as a cache in front of S3 for tools that insist on POSIX paths, not as cheap storage.

This is where the AI era shows up in S3, and where discipline matters most: a pipeline writing embeddings, scratch files and checkpoints to four bucket types needs tags, lifecycle rules and budgets from day one, because nobody will remember what the Express bucket in us-east-1a was for.

S3 security defaults in 2026: what you still have to do

The defaults now cover the classic leaks: new buckets are private, objects are encrypted, ACLs are off. What they do not cover:

• Bucket policies that grant Principal: "*". Block Public Access stops them only if you leave it on at the account level. Turn it on account-wide and treat any exception as a reviewed change.
• Over-broad IAM. s3:* on * in a CI role is still the most common finding I see. Scope roles to bucket ARNs and prefixes, and use OIDC rather than access keys for pipelines.
• SSE-KMS when you need key control. SSE-S3 protects against disk theft, not against someone with s3:GetObject. KMS keys add an auditable second permission. Turn on S3 Bucket Keys, or the KMS request charges will arrive on every GET.
• Versioning and Object Lock for anything a bad rm --recursive could destroy. Without a noncurrent-version expiry rule, versioning quietly grows your storage.

S3 vs Cloudflare R2 vs Google Cloud Storage

	Amazon S3 Standard	Cloudflare R2 Standard	Google Cloud Storage Standard
Storage $/GB-month	0.023 (us-east-1)	0.015	0.020 (Iowa, single region)
Writes per 1,000	$0.005	$0.0045 ($4.50 per million)	$0.005 (Class A)
Reads per 1,000	$0.0004	$0.00036 ($0.36 per million)	$0.0004 (Class B)
Internet egress	$0.09/GB after 100 GB free	free	billed per network pricing
Archive tiers	IA, three Glacier classes	Infrequent Access only	Nearline, Coldline, Archive
Source	AWS Price List	Cloudflare R2 pricing	GCS pricing

R2 wins on egress, and wins big: for a public asset store, zero egress beats every storage-class trick in this post. S3 wins when your compute is already in AWS (in-region transfer to EC2 is free), when you need archive tiers below a cent per GB, or when you need the ecosystem: events, Object Lock, replication, Athena. GCS mirrors S3 on price and fits when your compute is on Google Cloud. If you do decide to leave, AWS has offered free data transfer out for customers moving off AWS since March 2024, on request through support; Self-Hosting vs SaaS in 2026 has the wider repatriation picture.

FAQ

How much does Amazon S3 cost per TB in 2026?

S3 Standard costs $23.55 per TiB-month (1,024 GB at $0.023) in us-east-1 for the first 50 TB, before requests and egress. Standard-IA is about $12.80, Glacier Instant Retrieval about $4.10 and Glacier Deep Archive about $1.01 per TiB-month. Downloading that TiB to the internet costs roughly another $83 to $92 depending on your free allowance.

What is the difference between S3 Standard-IA and Glacier Instant Retrieval?

Both return data in milliseconds and both bill objects under 128 KB as 128 KB. Standard-IA stores for $0.0125 per GB with a 30-day minimum and $0.01 per GB retrieval; Glacier Instant Retrieval stores for $0.004 with a 90-day minimum and $0.03 per GB retrieval. Use Glacier Instant for data read about once a quarter or less, Standard-IA for monthly access.

Is S3 Intelligent-Tiering worth it?

For objects larger than roughly 250 KB with unknown access patterns, yes: there are no retrieval fees and the monitoring fee is $0.0025 per 1,000 objects a month. For small objects (never tiered under 128 KB) or data you delete within 30 days, it adds cost without saving anything.

Is Cloudflare R2 cheaper than S3?

For storage plus egress, usually yes: R2 storage is $0.015 per GB-month and egress is free, against S3's $0.023 and $0.09 per GB out. If your data is mostly read by compute inside AWS, the egress advantage disappears and S3's archive classes and integrations matter more.

This quarter I would do three things on any AWS account I am responsible for: turn on Block Public Access at the account level, add an abort-incomplete-multipart rule to every bucket, and open Cost Explorer grouped by usage type to see whether storage, requests or DataTransfer-Out-Bytes is really the big line. Only then would I touch storage classes, and for the public, download-heavy buckets, I would price R2 or a CloudFront flat-rate plan before tuning anything else. If you are putting a static site on S3 right now, the companion guide, How to Host a Static Website on S3 and CloudFront with HTTPS, does it with a private bucket and Origin Access Control.

Related: Terraform State in 2026: S3 Locking Replaced DynamoDB, What Else Changed, Self-Hosting vs SaaS in 2026: 37signals Saved $2M a Year. Should You? and Cloud Outages 2025-2026: What 7 Official Postmortems Actually Teach.