# Bucket Policies & Public Access — AWS

Source: https://www.geekswithgeeks.com/en/aws/aws-s3-bucket-policies

> Controlling who can read or write a bucket's objects.

## Bucket policies

A **bucket policy** is a JSON document attached directly to a bucket, defining who (which account, user, or 'everyone') can perform which actions on it.

## A public-read policy

Used for things like a static website's assets that should be publicly readable.

```json
{
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-site-bucket/*"
  }]
}
```

Output:

```
Anyone can GET objects from my-site-bucket
```

## Block public access by default

AWS's **Block Public Access** setting stops a bucket from ever becoming public, even by an accidental policy. Leave it on unless you deliberately need a public bucket.

**Quiz:** A company accidentally exposes customer data because a bucket became public. What AWS setting most directly guards against this?

- [ ] S3 storage classes
- [x] Block Public Access
- [ ] Lifecycle rules

*Answer:* Block Public Access. Block Public Access prevents a bucket from being made public even by a misconfigured policy.