Prevent public List/Put Operation on S3 with public access

user19875980 0
Viewed 22

What is the permission setting for amazon S3 if I want to allow browser to be able to fetch image from S3, but not allow list or put operation?

Only programmatic access is allowed for list/put operation.

Does unclicking Block all public access by default limit public access to download only?

amazon-s3 amazon-web-services
1 Answers

Assuming that you want the object to be publicly accessible to anybody who has the correct URL, there are two ways to make the object accessible.

Option 1: Object-level permissions

To make a specific S3 object 'public', you can change the Access Control List (ACL) on the object to 'Public'. This can either be done through the S3 console ("Make Public"), or while uploading the object to S3 (either via the console, via the AWS CLI or programmatically).

You will also need to deactivate Block S3 Access for the options that mention 'ACL'.

Option 2: Bucket-level permissions

To make all objects in the bucket 'public', then you can add a bucket policy that grants GetObject access to anyone, for example from Bucket policy examples - Amazon Simple Storage Service:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicRead",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
            ]
        }
    ]
}

You will also need to deactivate Block S3 Access for the options that mention 'Bucket Policy'.

Alternatively: Pre-signed URL

If, however, you want to make the object accessible to users who have authenticated to your application, then you can use an Amazon S3 pre-signed URLs, which is a time-limited URL that provides access to a private object.

John Rotenstein0
Related