AWS S3 : is it risky to set "Block all public access" to off?

user_2262854 0
Viewed 508

I want to share some public assets (images and fonts) with anyone who has the URL (read only).

I uploded the files to a new S3 bucket.

  • In Permissions > Block public access I set everything to Off

  • In Properties > Static website hosting I configured it as Use this bucket to host a website

Is it risky ? Can anybody write in my bucket because I set Block Public access to Off ?

amazon-web-services amazon-s3
1 Answers

This is normally done when setting bucket in website mode. From docs:

To make your bucket publicly readable, you must disable block public access settings for the bucket

What others can do, depends on bucket policy. For website, it should only allow read only access:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"PublicRead",
      "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:GetObject"],
      "Resource":["arn:aws:s3:::examplebucket/*"]
    }
  ]
}

As you can see, the policy allows only s3:GetObject. s3:PutObject is not included which would allow writing to the bucket.

user_2488230
Related