S3 promises eleven nines of durability. Written out that is 99.999999999 percent. The way Amazon frames it, if you store ten million objects, you might expect to lose one of them once every ten thousand years. That number is easy to quote and hard to actually feel, so let me unpack what has to be true for it to hold.
First, durability and availability are not the same thing, and conflating them is the most common mistake here. Availability is whether you can reach your data right now. Durability is whether your data still exists at all. A system can be briefly unavailable, a request times out, you retry, and nothing is lost. Losing data is forever. S3's famous number is about durability, and durability is the harder promise because there is no retry that brings back bytes that are truly gone.
So how do you not lose bytes? The whole game is redundancy plus independence of failures. If you keep one copy of an object on one disk, the durability of your object is exactly the durability of that disk, which is not great. Disks die constantly at scale. The fix is to store the data in multiple places such that the failures are uncorrelated. S3 spreads every object across multiple devices in multiple facilities within a region. The key word is uncorrelated. Three copies on three disks in the same rack sharing the same power supply is not three independent failures, it is one. Real durability comes from spreading across separate storage nodes, separate racks, and separate data centers so that no single fire, power loss, or network partition can take out all the copies at once.
