Cloud Storage

Cloud Storage holds objects — files — inside containers called buckets. An object has content, a name and metadata. There are no real directories; what looks like a folder path is simply part of the object name, which is why listing a large 'folder' can be slower than you expect.

Objects are immutable. You do not edit an object in place; you replace it. This constraint is what allows the service to be simultaneously enormously scalable and strongly consistent.

Object storage is the default home for anything that is not in a database: user uploads, images, video, backups, logs, exports, machine learning training data and data lake contents. It is usually the cheapest durable place to keep bytes.

It also underpins a great deal of other architecture. Analytics reads from it, pipelines stage data in it, and backups land in it. Understanding its cost model is one of the highest-leverage things you can learn about cloud economics.

• Bucket — the container. Its name is globally unique across all customers, and its location is fixed at creation and cannot be changed.
• Location type — regional for lowest latency and cost within one region; dual-region and multi-region for higher availability at higher cost.
• Lifecycle rules — automatic transitions between classes, or deletion, based on age, version count or other conditions.
• Object versioning — keeps previous versions when an object is overwritten or deleted. Protects against accidental deletion; also silently multiplies storage cost if you never expire old versions.
• Uniform bucket-level access — applies IAM consistently across the whole bucket instead of per-object access lists. The recommended default; per-object lists are hard to audit.
• Signed URL — a time-limited URL granting access to a specific object without the requester having any account. The standard way to let a user upload or download directly.
• Retention policy — prevents deletion for a defined period. When locked, it cannot be shortened even by an administrator, which is what makes it usable for compliance.
• Customer-managed encryption keys — everything is encrypted by default; this lets you control the key and therefore revoke access to the data by disabling it.

A frequent real-world mistake: moving frequently-read data to a colder class to save on storage, then paying far more in retrieval charges than was saved. Cold classes are for data you genuinely do not read.

• Storing user uploads and serving media through a content delivery network.
• Landing zone for a data lake, queried directly by analytics tools.
• Backup and disaster recovery targets with lifecycle rules moving older backups to colder classes.
• Hosting static website assets behind a load balancer.
• Staging exports between systems, including bulk data loads into a warehouse.
• Long-term compliance archives protected by a locked retention policy.