Bucket Policies & Public Access

Bucket policies

A bucket policy is a JSON document attached directly to a bucket, defining who (which account, user, or 'everyone') can perform which actions on it.

A public-read policy

Used for things like a static website's assets that should be publicly readable.

{
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-site-bucket/*"
  }]
}

Output:

Anyone can GET objects from my-site-bucket

Block public access by default

AWS's Block Public Access setting stops a bucket from ever becoming public, even by an accidental policy. Leave it on unless you deliberately need a public bucket.

Quick check: A company accidentally exposes customer data because a bucket became public. What AWS setting most directly guards against this?

• S3 storage classes
• Block Public Access
• Lifecycle rules