I allowed public access on my bucket's ACL from the Amazon S3 console. Is my bucket open to everyone?

Resolution

The Amazon S3 console allows you to grant only the READ and READ_ACP ACL permissions when you allow full public access to your bucket. You must use the AWS Command Line Interface (AWS CLI), AWS SDK, or Amazon S3 Rest API to grant WRITE and WRITE_ACP permissions to everyone. For more information on Amazon S3 permission groups, see Amazon S3 predefined groups.

Note: You can add public ACLs to a bucket only if you turn off Block public access to buckets and objects granted through new access control lists (ACLs). This setting must be turned off at both the bucket level and account level. Also, your bucket's ACLs won't work unless you turn off Block public access to buckets and objects granted through any access control lists (ACLs).

Even if you select all available ACL options in the Amazon S3 console, the ACL alone won't allow everyone to download objects from your bucket. However, any user can perform the following actions:

• If you select the Objects - List ACL option for the Everyone group, then anyone can get a list of objects in the bucket.
• If you select the Bucket ACL - Read ACL option for the Everyone group, then anyone can view the bucket's ACL.

To prevent accidental changes to the public access permissions on your bucket's ACL, you can configure public access settings for the bucket. If you select Block public access to buckets and objects granted through new access control lists (ACLs), then users can't add public ACLs to your bucket. Users also can't upload objects with public ACLs to your bucket when you select this option.

To override bucket permissions granted through public ACLs, select the Block public access to buckets and objects granted through any access control lists (ACLs) option. This option overrides public ACLs that are already on your bucket and denies new ACLs that are added to your bucket.

Important: You can't grant cross-account access through bucket and object ACLs for buckets that have S3 Object Ownership set to Bucket Owner Enforced. In most cases, ACLs aren't required to grant permissions to objects and buckets. Instead, use AWS Identity Access and Management (IAM) policies and S3 bucket policies to grant permissions to objects and buckets.

Related information

Blocking public access to your Amazon S3 storage

Access control list (ACL) overview