Configuring block public access settings for your S3 buckets - Amazon Simple Storage Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configuring block public access settings for your S3 buckets

Amazon S3 Block Public Access provides settings for access points, buckets, and accounts to help you manage public access to Amazon S3 resources. By default, new buckets, access points, and objects do not allow public access.

For more information, see Blocking public access to your Amazon S3 storage.

You can use the S3 console, Amazon CLI, Amazon SDKs, and REST API to grant public access to one or more buckets. You can also block public access to buckets that are already public. For more information, see the sections below.

To configure block public access settings for every bucket in your account, see Configuring block public access settings for your account. For information about configuring block public access for access points, see Performing block public access operations on an access point.

Amazon S3 Block Public Access prevents the application of any settings that allow public access to data within S3 buckets. This section describes how to edit Block Public Access settings for one or more S3 buckets. For information about blocking public access using the Amazon CLI, Amazon SDKs, and the Amazon S3 REST APIs, see Blocking public access to your Amazon S3 storage.

You can see if your bucket is publicly accessible in the Buckets list. In the Access column, Amazon S3 labels the permissions for a bucket as follows:

  • Public – Everyone has access to one or more of the following: List objects, Write objects, Read and write permissions.

  • Objects can be public – The bucket is not public, but anyone with the appropriate permissions can grant public access to objects.

  • Buckets and objects not public – The bucket and objects do not have any public access.

  • Only authorized users of this account – Access is isolated to IAM users and roles in this account and Amazon service principals because there is a policy that grants public access.

You can also filter bucket searches by access type. Choose an access type from the drop-down list that is next to the Search for buckets bar.

If you see an Error when you list your buckets and their public access settings, you might not have the required permissions. Check to make sure you have the following permissions added to your user or role policy:

s3:GetAccountPublicAccessBlock
s3:GetBucketPublicAccessBlock
s3:GetBucketPolicyStatus
s3:GetBucketLocation
s3:GetBucketAcl
s3:ListAccessPoints
s3:ListAllMyBuckets

In some rare cases, requests can also fail because of an Amazon Web Services Region outage.

To edit the Amazon S3 block public access settings for a single S3 bucket

Follow these steps if you need to change the public access settings for a single S3 bucket.

  1. Sign in to the Amazon Web Services Management Console and open the Amazon S3 console at https://console.amazonaws.cn/s3/.

  2. In the Bucket name list, choose the name of the bucket that you want.

  3. Choose Permissions.

  4. Choose Edit to change the public access settings for the bucket. For more information about the four Amazon S3 Block Public Access Settings, see Block public access settings.

  5. Choose the setting that you want to change, and then choose Save.

  6. When you're asked for confirmation, enter confirm. Then choose Confirm to save your changes.

You can change Amazon S3 Block Public Access settings when you create a bucket. For more information, see Creating a bucket.

To block public access on a bucket or to delete the public access block, use the Amazon CLI service s3api. The bucket-level operations that use this service are as follows:

  • PUT PublicAccessBlock (for a bucket)

  • GET PublicAccessBlock (for a bucket)

  • DELETE PublicAccessBlock (for a bucket)

  • GET BucketPolicyStatus

For more information and examples, see put-public-access-block in the Amazon CLI Reference.

Java

AmazonS3 client = AmazonS3ClientBuilder.standard()
	  .withCredentials(<credentials>)
	  .build();

client.setPublicAccessBlock(new SetPublicAccessBlockRequest()
		.withBucketName(<bucket-name>)
		.withPublicAccessBlockConfiguration(new PublicAccessBlockConfiguration()
				.withBlockPublicAcls(<value>)
				.withIgnorePublicAcls(<value>)
				.withBlockPublicPolicy(<value>)
				.withRestrictPublicBuckets(<value>)));
Important

This example pertains only to bucket-level operations, which use the AmazonS3 client class. For account-level operations, see the following example.

Other SDKs

For information about using the other Amazon SDKs, see Developing with Amazon S3 using the Amazon SDKs, and explorers.

For information about using Amazon S3 Block Public Access through the REST APIs, see the following topics in the Amazon Simple Storage Service API Reference.