S3 Security: Bucket Policy Hands On

🌐 Making an S3 Object Public Using a Bucket Policy

Objective making the coffee image available to public

1️⃣ Allow Public Access in Bucket Settings

1. Go to your bucket → Permissions tab.

   

2. Under Block Public Access, click ✏️ Edit.

   

3. Untick the box Block all public access and click Save Changes

   

4. Confirm with ✅ Yes → This allows you to attach a public bucket policy.

   

⚠️ Warning: Only do this if you intend for the bucket to be public. Otherwise, this could lead to data leaks.

2️⃣ Open the Bucket Policy Editor

1. In same page Scroll down to 📜 Bucket Policy → currently empty.

2. Click Edit Button

   

3. Use the 🛠️ AWS Policy Generator to create a public policy
   (Search AWS Policy Generator on Google)

https://awspolicygen.s3.amazonaws.com/policygen.html

3️⃣ Generate the Public S3 Policy

1. Go to AWS Policy Generator.

2. Select:

   

   • Policy Type: S3 Bucket Policy 📦

   • Effect: Allow ✅

     

   • Principal: Input a *which means (everyone)

   • Action: GetObject (to allow reading objects)

   • Amazon Resource Name (ARN):
     Copy your bucket ARN from the S3 console, add / * at the end
     You can get ARN from Bucket policy section

     

     arn:aws:s3:codeveda-dev-demo-s3/*
     

   • This ensures all objects inside the bucket are included.

3. Click Add Statement → then Generate Policy.

   

4️⃣ Apply the Policy

1. Copy the generated JSON policy.

   

2. Paste it into your 📜 Bucket Policy editor. Avoid any extra spaces or formatting issues.

   

3. Click 💾 Save changes.

   

5️⃣ Verify Public Access

1. Go to an object in your bucket or add one (e.g., coffee.jpg) ☕.

2. Copy the 🔗 Object URL.

3. Paste it in a browser → the image/file should now be publicly visible.

✅ Result: Your S3 bucket now allows anyone on the internet to access the objects inside.

To edit a bucket policy as an IAM user, that user must have the necessary IAM permissions to do so.

💡 Notes

• 👁️ GetObject action only allows reading. For uploads/deletes, you would need PutObject or DeleteObject.

• 📜 Bucket policy is preferred over ACLs for public access.

• 🔑 Pre-signed URLs are used for temporary access without making the bucket public.

• Always double-check that ⚠️ sensitive data is never made public.