49

"We highly recommend that you never grant any kind of public access to your S3 bucket."

I have set a very granular public policy (s3:GetObject) for one bucket that I use to host a website. Route53 explicitly supports aliasing a bucket for this purpose. Is this warning just redundant, or am I doing something wrong?

  • 1
    @MichaelHampton It will show this in the S3 console, without much additional context. businessinsights.bitdefender.com/… – ceejayoz Dec 16 '17 at 22:53
  • Related - can AWS see into a private bucket or does it have to be public for AWS to access files inside? – Criggie Dec 18 '17 at 19:12
  • @Criggie AWS being their support team? Or something else? – ceejayoz Dec 20 '17 at 19:37
  • @ceejayoz yes the AWS support team. – Criggie Dec 21 '17 at 0:18
  • I'd imagine at a certain level of support they might poke around inside, although S3 supports encryption with a non-Amazon key. Their processes should ensure it's not done without explicit permission, I'd think. – ceejayoz Dec 21 '17 at 1:05
63

Yes, if you know what you're doing (edit: and everyone else with access to it does, too...), you can ignore this warning.

It exists because even large organizations who should know better have accidentally placed private data into public buckets. Amazon will also send you heads-up emails if you leave buckets public in addition to the in-console warnings.

Accenture, Verizon, Viacom, Illinois voter information and military information has all been found inadvertently left open to everyone online due to IT bods misconfiguring their S3 silos.

If you are absolutely, 100% certain that everything in the bucket should be public and that no one's going to accidentally put private data in it - a static HTML site's a good example - then by all means, leave it public.

  • 1
    In practice, you're virtually never 100% certain, so best practice is to don't. – Shadur Dec 17 '17 at 20:32
  • It was just a few months ago where either the FBI or CIA left private data that was supposed to be secure on a public S3. I'll see if I can find a link to the news article. – Reactgular Dec 18 '17 at 15:47
  • See here: gizmodo.com/… – Reactgular Dec 18 '17 at 15:49
  • Good sire, can you guide me how to specifically allow only my website and Android app to be able to access my bucket's objects? Basically I don't want people scraping my bucket contents. But my website and app should be able to load them. – bad_keypoints Dec 29 '18 at 17:04
33

The privacy issue featured in ceejayoz's answer is not the only problem.
Reading objects from an S3 bucket has a price. You will be billed by AWS for each download from this bucket. And if you have a lot of traffic (or if someone who wants to hurt your business starts to heavily download files all day long) it will quickly become expensive.

If you want files from your bucket to be publicly accessible, you should create a Cloudfront Distribution that points to and is granted access to the S3 bucket.

Now, you can use the Cloudfront Distribution's domain name to serve your files without granting any S3 access to the public.
In this configuration, you pay for Cloudfront's data usage instead of S3's. And at higher volumes it's a lot cheaper.

  • 2
    CloudFlare also works, and is likely to be cheaper still. – chrylis Dec 18 '17 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.