Making Amazon S3 Objects Public with a Bucket Policy

Purpose of This Lesson

This lesson demonstrates how to make objects in an Amazon S3 bucket accessible through a public URL by combining S3 Block Public Access settings with a bucket policy. It also shows how to use the AWS Policy Generator to create a policy that permits anonymous GetObject requests.

Because this configuration can expose every object in a bucket, it should be used only when public access is explicitly required and the data is appropriate for public distribution.

Key Concepts

• S3 Block Public Access: Account- or bucket-level protections that prevent public access configurations. These settings must be changed before a public bucket policy can take effect.
• Bucket policy: A resource-based policy attached to an S3 bucket. It can define who may perform actions on resources in that bucket.
• Principal: The identity to which a policy applies. Using "*" means any requester, including unauthenticated public users.
• s3:GetObject: The permission needed to read an object from S3.
• Amazon Resource Name (ARN): The resource identifier used in the policy. For object access, the bucket ARN must be followed by /* to match objects inside the bucket.
• Object URL: The URL associated with an S3 object. Once the policy permits anonymous reads, the object can be retrieved through its public URL.

S3 Public-Access Configuration Workflow

1. Review the data and the intended exposure

Before changing permissions, verify that the bucket contains no confidential, personal, proprietary, or otherwise sensitive data. Making the bucket public can expose all matching objects to anyone who can access their URLs.

2. Disable the relevant Block Public Access protection

In the bucket’s Permissions settings, edit the Block Public Access configuration and untick the setting that prevents public access. Confirm the warning only when a public bucket policy is intentional.

This is a prerequisite for the bucket policy in this workflow. It is not a generally recommended setting for ordinary company data.

3. Create a bucket policy

Under Bucket policy, use either the policy documentation examples or the AWS Policy Generator. For this use case, configure an S3 Bucket Policy with:

• Effect: Allow
• Principal: *
• Action: s3:GetObject
• Resource: the bucket ARN followed by /*

A representative policy is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

The bucket name in the ARN must be replaced with the actual bucket name. The /* suffix is important: s3:GetObject applies to objects, so the resource must match objects beneath the bucket rather than only identifying the bucket itself.

4. Save and validate

Save the policy, open an object such as coffee.jpg, copy its object URL, and test the URL. If the policy and public-access settings are correct, the object should be visible without requiring authenticated AWS access.

Exam- or Assessment-Relevant Takeaways

• A public bucket policy alone may not work if S3 Block Public Access settings still prevent public access.
• Principal: "*" means the permission applies to everyone, not just users in the AWS account.
• Public read access requires s3:GetObject, not merely a permission on the bucket resource.
• An object resource ARN uses the bucket ARN plus /*, for example arn:aws:s3:::bucket-name/*.
• Distinguish the bucket ARN from the object ARN pattern: the bucket ARN identifies the bucket, while the suffix identifies objects inside it.
• Public access is a high-risk configuration. The decision to enable it should be driven by a clear requirement to distribute data publicly.

Tool / Feature Decision Guide

Situation	Appropriate choice	Reason
You need to construct a policy interactively	AWS Policy Generator	Select the S3 policy type, effect, principal, action, and resource, then generate the JSON.
You need to understand supported policy patterns	S3 bucket policy documentation examples	The examples provide use cases and corresponding policy structures.
You need anonymous access to objects	Principal: "*" with s3:GetObject	This grants object reads to any requester.
You need to identify all objects in a bucket policy	Bucket ARN followed by /*	The wildcard matches objects beneath the bucket.
You are storing private company data	Keep public access blocked	Public exposure can create a serious data leak.

Common Traps / Misconceptions

• Trap: A public object URL automatically means the object is public. The URL alone does not grant access; the S3 access configuration and policy must permit the request.
• Trap: Changing only the bucket policy is sufficient. Block Public Access settings can still prevent the public policy from being effective.
• Trap: Using only the bucket ARN for GetObject. Object-level actions need an object resource pattern, such as arn:aws:s3:::bucket-name/*.
• Trap: Principal: "*" means all authenticated AWS users. It means anyone, including unauthenticated internet users.
• Trap: Making one image public affects only that image. A policy with /* applies to every object matched in the bucket.
• Trap: Public access is harmless for a test configuration. If real data is present, the same configuration can cause an unintended data leak.

Real-World Engineer / Analyst Notes

• Treat enabling public access as an exception that requires an explicit business or application requirement.
• Inspect the bucket contents before applying a policy that matches all objects.
• Prefer the narrowest resource and permission scope that satisfies the use case. The demonstrated policy intentionally grants broad anonymous read access and should not be copied blindly.
• After saving a policy, validate with the actual object URL and confirm that the observed behavior matches the intended audience.
• When reviewing a policy, check the combination of principal, action, and resource rather than evaluating any one field in isolation.

Quick Reference Summary

• Prerequisite: Public access protections must allow the intended public configuration.
• Policy effect: Allow
• Public principal: "*"
• Read action: s3:GetObject
• Object resource pattern: arn:aws:s3:::bucket-name/*
• Validation: Open an object’s S3 URL without relying on authenticated access.
• Primary risk: Any object matched by the policy may be readable by anyone.

Flashcards

Q: A team needs an S3 object to load from a public URL, but the bucket policy appears correct and access is still blocked. What should you inspect first?

A: Inspect the bucket’s Block Public Access settings. Those protections can prevent a public bucket policy from taking effect.

Q: Which principal represents anonymous public access in the demonstrated bucket policy?

A: "*". It applies to any requester, including users who are not authenticated to AWS.

Q: Which S3 action is required to let public users read an object?

A: s3:GetObject, because the requested operation is reading an object.

Q: Why does the resource ARN end with /* in the public-read policy?

A: The bucket ARN identifies the bucket, while /* matches objects inside it. The object action must target object resources.

Q: When should you consider disabling the relevant S3 Block Public Access protection?

A: Only when a public bucket policy is deliberately required and the data is safe to expose publicly. It should not be casually disabled for company data.

Q: What is the difference between the bucket ARN and the object resource pattern used here?

A: The bucket ARN identifies the bucket itself, while the bucket ARN plus /* identifies objects beneath that bucket.

Q: You want all objects in a bucket to be readable by anyone. Which combination matches the demonstrated approach?

A: Use Principal: "*", Effect: "Allow", Action: "s3:GetObject", and a resource of bucket-arn/*, after allowing the public configuration in Block Public Access settings.

Q: What is the main security risk of using Principal: "*" with a wildcard object resource?

A: Anyone may read any object matched by the policy. If sensitive data is present, this can cause a data leak.

Q: When would the AWS Policy Generator be useful in this workflow?

A: Use it to select the S3 policy type, effect, principal, action, and resource and then generate the corresponding policy JSON.

Q: What should you do after saving a public bucket policy?

A: Open an object such as coffee.jpg, copy its object URL, and test whether it is accessible as intended.

Q: Why is a public policy affecting /* broader than a policy for one object?

A: The wildcard matches all objects under the bucket, whereas a specific object resource would restrict access to one object.

Q: A bucket contains private company files and one image that must be publicly displayed. What is the key trap in applying the demonstrated policy unchanged?

A: The wildcard resource would expose all matching objects, not just the image. The demonstrated policy is intentionally broad and must not be applied without considering the bucket’s contents.

Practice Questions

Question 1

An engineer adds an S3 bucket policy allowing s3:GetObject to Principal: "*", but a browser request to an object still fails. The bucket’s public-access blocking settings have not been changed. What is the most likely cause?

A. s3:GetObject cannot be used with object URLs
B. Block Public Access is still preventing the public policy
C. The principal must be the bucket owner
D. The bucket ARN must omit the object wildcard

Correct answer: B

Explanation: The workflow requires allowing the intended public configuration in Block Public Access before the public bucket policy can work.

Question 2

A policy grants s3:GetObject on arn:aws:s3:::reports-bucket, but requests for objects inside the bucket are not covered as intended. Which resource should be used for all objects in the bucket?

A. arn:aws:s3:::reports-bucket/*
B. arn:aws:s3:::reports-bucket/GetObject
C. arn:aws:s3:::*/reports-bucket
D. arn:aws:s3:::reports-bucket/object/*

Correct answer: A

Explanation: The /* suffix represents objects beneath the bucket and is the pattern used with s3:GetObject in this lesson.

Question 3

A company wants a public image but also stores confidential reports in the same S3 bucket. An engineer proposes a policy with Principal: "*" and resource arn:aws:s3:::bucket-name/*. What is the decisive concern?

A. The policy permits only the image to be read
B. The policy exposes every object matched by the wildcard
C. The policy grants write access to the reports
D. The policy prevents the image from being accessed by URL

Correct answer: B

Explanation: The wildcard resource covers all objects in the bucket, so the policy can expose confidential reports as well as the image.

Question 4

An engineer wants help building the JSON for an S3 bucket policy and needs to choose the effect, principal, action, and resource interactively. Which tool from the lesson is most appropriate?

A. AWS Policy Generator
B. The S3 object URL
C. The bucket ARN alone
D. Block Public Access without a policy

Correct answer: A

Explanation: The AWS Policy Generator supports selecting the S3 policy parameters and generating the policy document.

WordPress Metadata

Suggested Slug:
s3-public-object-access-bucket-policy

Meta Description:
Learn how to configure S3 Block Public Access and a bucket policy to expose objects through public URLs while avoiding broad data exposure.

Tags:
AWS, Amazon S3, S3 bucket policies, Block Public Access, IAM policies, cloud security, object storage, AWS Policy Generator, public data access, data protection