Problem: S3 Bucket Policy Blocks Public Access Unexpectedly

Problem: S3 Bucket Policy Blocks Public Access Unexpectedly

$ aws s3 cp myfile.txt s3://my-public-bucket/ --acl public-read
An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

$ aws s3api get-bucket-policy --bucket my-public-bucket
{
    "Policy": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::my-public-bucket/*",
                "Condition": {
                    "Bool": {
                        "aws:SecureTransport": "false"
                    }
                }
            }
        ]
    }
}

$ aws s3api get-public-access-block --bucket my-public-bucket
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": true,
        "BlockPublicPolicy": true,
        "RestrictPublicBuckets": true
    }
}

Issue:

The file upload fails because public access is blocked at two levels:

• Bucket Policy Restriction – The bucket policy explicitly denies access unless using HTTPS.
• Public Access Block Settings – The bucket has public access restrictions enabled.

Fix: Update Bucket Policy and Public Access Settings

# Step 1: Remove Public Access Block settings to allow public policies
$ aws s3api delete-public-access-block --bucket my-public-bucket

# Step 2: Replace the existing restrictive bucket policy with a new one that allows public reads
$ aws s3api put-bucket-policy --bucket my-public-bucket --policy '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-public-bucket/*"
        }
    ]
}'

# Step 3: Retry uploading the file with public-read ACL
$ aws s3 cp myfile.txt s3://my-public-bucket/ --acl public-read
upload: ./myfile.txt to s3://my-public-bucket/myfile.txt

# Step 4: Verify that the file is now publicly accessible
$ curl -I https://my-public-bucket.s3.amazonaws.com/myfile.txt
HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 12345

Need AWS Expertise?

If you're looking for guidance on AWS challenges or want to collaborate, feel free to reach out! We'd love to help you tackle your AWS projects. 🚀

Email us at: info@pacificw.com

Image: Gemini