Allowing Anyone to Read but Not Write in AWS S3

Amazon Simple Storage Service (AWS S3) is a highly scalable object storage service that offers reliable and cost - effective data storage. In many scenarios, you might want to make your S3 objects publicly readable while preventing unauthorized writing. For example, hosting static websites, sharing data for public consumption like research papers or media files. This blog post will delve into the core concepts, typical usage scenarios, common practices, and best practices for enabling anyone to read but not write in AWS S3.

Table of Contents#

  1. Core Concepts
  2. Typical Usage Scenarios
  3. Common Practice
  4. Best Practices
  5. Conclusion
  6. FAQ
  7. References

Article#

Core Concepts#

AWS S3 Buckets#

An S3 bucket is a container for objects stored in S3. Buckets are the fundamental unit of storage in AWS S3, and they are created in a specific AWS region. Each bucket has a globally unique name across all AWS accounts.

S3 Bucket Policies#

Bucket policies are JSON - based access policies that you can attach to an S3 bucket. They are used to manage permissions at the bucket level. You can use bucket policies to allow or deny access to the bucket and its objects.

ACLs (Access Control Lists)#

ACLs are another way to manage access to S3 buckets and objects. They are more granular than bucket policies and can be used to grant specific permissions to AWS accounts or predefined groups.

Public Access#

Making an S3 bucket or object public means that anyone on the internet can access it. AWS provides controls to manage public access to buckets and objects to ensure data security.

Typical Usage Scenarios#

Static Website Hosting#

When hosting a static website on S3, you need to make the website files publicly readable so that visitors can access the web pages. At the same time, you don't want anyone to modify these files, as it could disrupt the website's functionality.

Data Sharing#

Sharing data such as research reports, open - source datasets, or media files (like images, videos) with the public. The data should be available for viewing or downloading, but not for unauthorized modification.

Content Delivery#

For content delivery networks (CDNs), S3 can be used as an origin. The content in the S3 bucket needs to be publicly accessible for the CDN to cache and deliver it to end - users, while write access should be restricted to maintain data integrity.

Common Practice#

Step 1: Create an S3 Bucket#

Log in to the AWS Management Console and navigate to the S3 service. Click on "Create bucket" and follow the wizard to create a new bucket. Choose a unique name and the appropriate AWS region.

Step 2: Configure Bucket Policy#

To make the bucket publicly readable but not writable, you can use the following bucket policy example:

{
    "Version": "2012 - 10 - 17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::your - bucket - name/*"
        }
    ]
}

In this policy, the Effect is set to Allow, the Principal is set to * (which means all principals), the Action is s3:GetObject (allowing only read operations), and the Resource specifies the objects in the bucket.

Step 3: Disable Public Access Block (if necessary)#

By default, AWS S3 has public access block settings that prevent buckets from being publicly accessible. You may need to adjust these settings to allow public read access. Navigate to the bucket's properties, and under "Block public access (bucket settings)", uncheck the relevant options if you want to make the bucket publicly readable.

Best Practices#

Use IAM Roles for Internal Access#

For internal users or applications that need to write to the bucket, use AWS Identity and Access Management (IAM) roles instead of relying on public access. This provides better security and control over who can modify the data.

Regularly Review Bucket Policies#

Periodically review your bucket policies to ensure that they still meet your security requirements. As your application or data usage changes, the policies may need to be updated.

Enable Server - Side Encryption#

Enable server - side encryption for your S3 bucket to protect the data at rest. This adds an extra layer of security, even if the data is publicly readable.

Monitor Access Logs#

Use AWS CloudTrail to monitor access to your S3 bucket. This helps you detect any unauthorized access attempts and take appropriate action.

Conclusion#

Allowing anyone to read but not write in AWS S3 is a common requirement in many scenarios. By understanding the core concepts of S3 buckets, bucket policies, and ACLs, and following the common practices and best practices outlined in this blog, software engineers can effectively manage public access to their S3 data while maintaining data integrity and security.

FAQ#

Q1: Can I make only specific objects in a bucket publicly readable?#

Yes, you can modify the bucket policy to specify the exact objects or object prefixes that you want to make publicly readable.

Q2: What if I accidentally make my bucket writable to the public?#

Immediately review and update your bucket policy to remove the write permissions. Also, monitor the access logs to check if any unauthorized write operations have occurred.

Q3: Is it possible to make a bucket publicly readable in one region and not in another?#

No, bucket policies are applied globally to the bucket. However, you can create separate buckets in different regions with different access policies.

References#

2025-10