Bucket Policies and Public Access
Inkwell wants shoppers' browsers to load cover images straight from S3. The same bucket also holds a folder of order invoices with customer addresses. One careless setting could expose both. S3 gives you two tools that must be understood together: the bucket policy that grants access, and the Block Public Access switch that can veto it.
The rule
The bucket policy grants; Block Public Access vetoes anything public.
A bucket policy is a resource-based policy: it is attached to the bucket, not to a user, so it must name the Principal, meaning who it applies to. Everything else works like the IAM policies you already know: Effect, Action, Resource, deny wins.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::inkwell-covers/covers/*"
}
]
}"Principal": "*" means anyone, including anonymous visitors. The resource is only the covers/ prefix, so invoices remain private through the implicit deny.
Block Public Access is a set of four settings, available on each bucket and for the whole account, that stop public access through bucket policies and ACLs (older per-object permission lists). New buckets have it switched on, and new buckets also have ACLs disabled. While it is on, the policy above is refused. You must turn it off on purpose, which is exactly the point: public exposure should never happen by accident.
A bucket policy is also how you share with another AWS account: name that account or one of its roles as the Principal. Access within one account is allowed if either the identity policy or the bucket policy allows it; across accounts, both sides must allow it.
The shortcut
For every request, run the three gates: Does any policy explicitly deny it? Is it public, and is Block Public Access on? Does an applicable policy allow it? A deny, a public request while Block Public Access is on, or no allow each mean no.
covers/2026/the-river.jpg
No deny. It is public, so Block Public Access must be off for this bucket. The policy allows
covers/*. Served.
The safer default is to never make the bucket public: keep Block Public Access on and put CloudFront in front, with origin access control so only CloudFront may read the bucket.
Drills
Answer fast — trust the rule.
What does "Principal": "*" mean in a bucket policy?
Inkwell adds a public-read bucket policy, but Block Public Access is still on. What happens?
Why must a bucket policy include a Principal, when a group's policy does not?
An account-B role needs to read Inkwell's bucket in account A. What is required?
Remember
- The bucket policy grants; Block Public Access vetoes anything public.
- Three gates: explicit deny, public veto, then an allow. Across accounts, both sides must allow.
- Safer default: keep the bucket private and serve public files through CloudFront.