One of the foundational security elements of S3 is to ensure S3 buckets are not publicly available. It’s such an established best practice that AWS actually makes it pretty difficult for S3 buckets and their objects to become public. In this demo, our AWS expert will show you the steps that AWS has put into place to protect S3 buckets from public accessibility.  

- Block Public Access to Buckets and Objects Granted Through New ACLs 

- Block Public Access to Buckets and Objects Granted Through Any ACLs 

- Block Public Access to Buckets and Objects Granted Through New Public Bucket or Access Point Policies 

- Block Public Access to Buckets and Objects Granted Through Any Public Bucket or Access Point Policies 

For a visual guide on how to configure and restrict access to S3 buckets, watch the full demo. 

You’ll see, here, that we are logged in to our S3 console and we have our bucket. The first thing that we’ll point out is that “Bucket and Objects are Not Public.” So, right now, the settings are set up that we can’t do that. Let’s just try under “Access Control” and you see our ability to actually make this file accessible to everyone is prohibited. They have that greyed out. Let’s go back to our bucket policy and go to “Permissions.” In this case, we will turn this off. Now, we are no longer globally blocking public access. We also had to type in Confirm in order to change that setting. Now, we see that “Objects Can Be Public.” If we click on that, it says, “The bucket is not public but anyone with appropriate permissions can grant public access to objects.” 

Let’s go back to our “Objects,” come down here to the placeholder file, edit “Access Control List,” and we can make this object readable. Notice that we also need to do another confirmation or else this isn’t going to stick. They truly do try to make it hard, at least through the console, to override the public nature of content in buckets. 

Sure enough, if we save this and come over here to our “Object URL” – sure enough I can read that file. There’s our placeholder text. Now, let’s come back to our bucket. “Objects Can Be Public” is still up there. Sure enough, we just demonstrated that we do have at least one public object. Come back over here to “Permissions” and now we will try to make our bucket public so that we can read and list all of the objects in the bucket and everything else. We see up here that it has switched to “Public” and it’s red. It reads, “This bucket can be accessed by anyone on the Internet. Unless you require a public configuration for a specific verified use case, AWS recommends that you block all public access to your buckets.” Let’s try coming back over here to our “Objects.” The placeholder file, we already know, is public. So, we will try to open this up again. Sure enough, it works. 

Let’s try the same thing on the second placeholder file and open this up in a new tab. You see we get AccessDenied and that is because this object does not currently have any read permissions set up for public. Let’s try to do that. I will save changes, again. Let’s try to refresh this. Now, I get InvalidArgument. In another video where we were discussing S3 encryption settings, we explained the difference between using SSE-S3 and using SSE-KMS, especially with a customer master key. This is what we’re seeing here, because even though this object is in a publicly-accessible bucket with a publicly-accessible access control list, it is encrypted with SSE-KMS using our own key. So, the encryption settings have taken precedent. The public user with anonymous Internet access is unable to decrypt the file. This is another advantage of using SSE-KMS with a customer master key that you specify. You get that additional layer of protection even if the bucket and the objects slip into a publicly-accessible access control list, that the files are still protected with encryption. 

There’s one more thing to demonstrate, here, so now we will come back to our “Permissions” and we will block all access again. We have to type in Confirm. Sure enough, it reads “Bucket and Objects are Not Public.” If we come back here and try to grab our placeholder file, we get AccessDenied.