How should Amazon S3 be designed for production in AWS?

Block public access unless explicitly required, use IAM roles, enable encryption and versioning where appropriate, apply lifecycle rules, and use presigned URLs for controlled client access.