Make s3 file in bucket public as default

Question

My s3 bucket sertting Access is public and block public aceess is off

Now I uploaded the file by aws-web console.

The file is blocked from public.

I check the page here and set

Bucketpolicy is like this below.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "s3:GetBucket*",
            ],
            "Resource": [
                "arn:aws:s3:::si12-s3-resource-up",
                "arn:aws:s3:::si12-s3-resource-up/*"
            ]
        }
    ]
}

However ,still the same.

Where the point should I check more?

After uploading the file manually.

comes to each object page and set ACL as public to everyone.

The file can be seen.

SO,,,,in my opinion.

Bucket policy is set but somehow ACL is prioritized or bucket policy is ignored???

Solution

I off the ACL and set

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket--name/*"
        }
    ]
}

It works, I am not sure why former bucket policy doesn't work

But thank you very much for comment.

Your bucket policy is highly insecure and shouldn't be used. it allows for anyone in the world to delete your objects. — Marcin, Feb 25 '22 at 07:01
Thanks I delete other than GetBucket, but the problem is still the same. — whitebear, Feb 25 '22 at 07:03
Can you please try with 'acl': 'public-read' in the destination object. — Jijo Alexander, Feb 25 '22 at 07:05
Yes, it works. @Jiji Alexander, However how can I make this public as default? — whitebear, Feb 25 '22 at 07:07
I set ACL invalid ,and it looks like only bucket policy works, ,, but situation continues... — whitebear, Feb 25 '22 at 07:11

score 2 · Accepted Answer · answered Feb 25 '22 at 07:15

Use this policy in Bucket to make the object public, please don't allow DELETE operations with public access, If your application wants programmatically delete then better create ROLE for that and assign to your machine that application is running.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action":["s3:GetObject"],
            "Resource":[ 
                "arn:aws:s3:::si12-s3-resource-up",
                "arn:aws:s3:::si12-s3-resource-up/*"
            ]
        }
    ]
}

Also, Use the add the ACL in the destination object in django-s3direct

S3DIRECT_DESTINATIONS = {
    'example_destination': {
        'key': 'uploads/images',
        'acl': 'public-read', # [optional] Custom ACL for object is 'private'
        'server_side_encryption': 'AES256',
    }
}

Only one of these methods is required -- either a Bucket Policy, or setting `ACL=public-read`. It is not necessary to use both methods. — John Rotenstein, Feb 25 '22 at 08:08

Make s3 file in bucket public as default

1 Answers1