Private by default
A new bucket follows the rule you have now seen three times (IAM 2-2, security groups 3-3): everything is denied until a policy allows it. Only your account can touch the objects.
Access opens up two ways:
- IAM policies (lesson 2-2) grant your users and roles access, like the photo-app role reading
my-app-photos/*. - A bucket policy is a policy attached to the bucket itself, and it can grant access to anyone, including the whole internet, with
"Principal": "*".
Public buckets are behind years of headlines about leaked customer data, so AWS added Block Public Access, an account-wide master switch that overrides any accidental public policy. You switch it off only for buckets that are meant to be websites.
Code exercise · bash
Block Public Access sits on top of normal policy evaluation as a final override, the same explicit-deny-wins idea from lesson 2-2 packaged as one switch. This function is that decision in miniature. Run it for three buckets: the switch on with a public policy, off with a public policy, and off with no public policy.
Static website hosting
A static site is files that do not change per visitor: HTML, CSS, JavaScript, images. Think of a portfolio, docs, or the built output of a React app.
You have served files by running nginx in a container. S3 removes even that: enable website hosting on a bucket, make it publicly readable, upload, done. No instance, no security group, no patching, and it costs cents.
aws s3 website s3://my-portfolio --index-document index.html aws s3 sync ./build s3://my-portfolio
sync uploads whatever changed in ./build, so a deploy is one command. The capstone (lesson 9-1) builds a production version of this with HTTPS and a CDN (content delivery network) in front — a worldwide set of cache servers that hold copies of your files close to each visitor.
Quiz
Your React app's build folder needs hosting. Traffic is small and there is no server-side code. The S3 option beats an EC2 + nginx setup because:
Problem
Spot the misconfiguration. A bucket policy for the private bucket acme-payroll reads: Effect Allow, Principal "*", Action "s3:GetObject", Resource "arn:aws:s3:::acme-payroll/*". Payroll PDFs are leaking. Which single character in that policy opened the bucket to everyone?