S3 Bucket Policy Project 1: Public Read-Only Static Website

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Everyday project story

Jaipur travel founder Ananya Sharma and Berlin curator Lukas Weber both host static HTML. They need Principal "*" GetObject on objects, while Put/Delete stay with admin IAM only. Deeper than a one-line example — you ship, test, and tear down.

Related survey (short examples): S3 bucket policy examples. This chapter is the full project lab.

2. Why this policy?

Why do we need this?

Static files need a public read path without opening write. Mixing private PII in the same bucket is how leaks happen — use a dedicated public assets bucket.

• Anyone can GET objects (browser, curl, CDN later)
• Nobody anonymous can PUT/DELETE
• Admins still manage files via IAM roles
• BPA must allow the public policy without opening ACLs if possible

3. What is the policy?

What is it?

A resource-based policy on the bucket. One Allow statement: Principal *, Action s3:GetObject, Resource arn:aws:s3:::BUCKET/*.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::rb-bakery-site-ap-south-1/*"
    }
  ]
}

Line-by-line

1. Version 2012-10-17 — current policy language.
2. Sid PublicReadGetObject — label for reviews.
3. Effect Allow — grant this statement.
4. Principal * — anonymous and signed callers for this action.
5. Action s3:GetObject — read object bytes only (not ListBucket, not PutObject).
6. Resource .../bucket/* — all objects; GetObject never uses the bare bucket ARN.

4. How to do it (CLI with output)

How to do it (step by step)

# Create bucket in Mumbai
aws s3api create-bucket --bucket rb-bakery-site-ap-south-1 --region ap-south-1 \
  --create-bucket-configuration LocationConstraint=ap-south-1
# {"Location": "http://rb-bakery-site-ap-south-1.s3.amazonaws.com/"}

# BPA: allow public policy; keep ACL blocks on
aws s3api put-public-access-block --bucket rb-bakery-site-ap-south-1 --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=false,RestrictPublicBuckets=false

aws s3api put-bucket-policy --bucket rb-bakery-site-ap-south-1 --policy file://public-read.json
# (empty success)

echo "<h1>Menu - Priya Bakery Pune</h1>" > index.html
aws s3 cp index.html s3://rb-bakery-site-ap-south-1/index.html --content-type text/html
aws s3 website s3://rb-bakery-site-ap-south-1/ --index-document index.html --error-document index.html

5. Test: allowed and denied

# ALLOW — anonymous GET
curl -s -o /dev/null -w "%{http_code}\n" \
  https://rb-bakery-site-ap-south-1.s3.ap-south-1.amazonaws.com/index.html
# 200

# DENY — anonymous PUT
curl -s -o /dev/null -w "%{http_code}\n" -X PUT --data hack \
  https://rb-bakery-site-ap-south-1.s3.ap-south-1.amazonaws.com/hack.txt
# 403

6. Multi-industry

Ecommerce menus (Pune — Priya Deshmukh), NGO pages (Nairobi — Amina Okello), school timetables (Nagpur — Rohan Patil), museum catalogues (Berlin — Lukas Weber), QR menus (Chennai — Meera Iyer).

7. Security checklist

• Dedicated public bucket; zero PII/secrets
• Only GetObject public; no ListBucket public
• Keep BlockPublicAcls true when possible
• Add CloudFront later for HTTPS custom domain

8. AccessDenied debugging and Policy Simulator

When S3 returns AccessDenied, check in order: (1) Block Public Access, (2) matching bucket policy Deny, (3) missing IAM Allow, (4) KMS key policy, (5) VPC endpoint policy, (6) legacy ACL. IAM Policy Simulator can miss BPA/VPC/KMS — always re-test with real CLI from the real network path.

# Decode
aws s3api get-bucket-policy --bucket BUCKET --query Policy --output text | python3 -m json.tool
aws s3api get-public-access-block --bucket BUCKET
aws iam simulate-principal-policy --policy-source-arn ARN \
  --action-names s3:GetObject --resource-arns arn:aws:s3:::BUCKET/key.txt
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=GetObject --max-items 5

9. Industries and roles

• Frontend: marketing sites without EC2
• DevOps: BPA + policy as code
• Security: review Principal * every quarter

10. Lab: public read-only bakery site

Do this in ap-south-1 (Mumbai) unless your org forbids it. Set a budget alert first.

How to do it (step by step)

1. Create rb-bakery-site-ap-south-1 in ap-south-1.
2. Tune BPA; put PublicReadGetObject policy; upload index.html.
3. curl GET → 200; curl PUT → 403; save both outputs.
4. Enable static website hosting; open website endpoint.

Cleanup (stop billing)

1. Delete objects, delete bucket policy, delete bucket.
2. Restore account BPA if you changed it.

11. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

12. Troubleshooting checklist

1. Confirm region and endpoint hostname for the bucket.
2. Print get-bucket-policy and get-public-access-block.
3. Reproduce with a least-privilege lab IAM user.
4. Binary-search Denies by commenting one Sid at a time in lab.
5. Read CloudTrail errorCode and additionalEventData.
6. If KMS involved, test key permissions separately.
7. From VPC path: route to gateway prefix list + endpoint policy.
8. Cleanup versioning/Object Lock labs carefully.

13. FAQ

14. Interview Q&A

15. Tips in English, Marathi and Hindi

16. Policy design checklist before you save

1. Write the business rule in one sentence (who can do what from where).
2. Choose Allow vs Deny-unless consciously; remember explicit Deny wins.
3. List every Resource ARN shape you need (bucket vs bucket/*).
4. Name every Condition key exactly (case-sensitive).
5. Decide BPA settings before put-bucket-policy.
6. Plan the allow test and the deny test with expected HTTP/CLI codes.
7. Plan cleanup (versioning, Object Lock, KMS schedules).
8. Paste JSON through python3 -m json.tool before apply.

17. Policy Simulator walkthrough

IAM Policy Simulator is great for identity policies and a first pass on resource policies, but it can miss Block Public Access, VPC endpoint policies, and some KMS denials. Use it to catch typos, then always re-test with AWS CLI from the real network path (office IP, VPC, or CloudFront).

1. Open IAM → Policy simulator → pick the user/role.
2. Add action s3:GetObject / PutObject and the object ARN.
3. If you use resource policies, include the bucket policy text where the tool allows.
4. Note Allow/Deny; then run the matching CLI from the real path.
5. If Simulator Allow but CLI Deny, check BPA, VPCe, KMS, and explicit Denies next.

18. Copy-paste runbook (print this)

# 0) Region + names
export AWS_REGION=ap-south-1
export BUCKET=rb-lab-$(date +%s)-ap-south-1

# 1) Create + show BPA
aws s3api create-bucket --bucket $BUCKET --region $AWS_REGION \
  --create-bucket-configuration LocationConstraint=$AWS_REGION
aws s3api get-public-access-block --bucket $BUCKET || true

# 2) Validate + apply policy
python3 -m json.tool policy.json >/dev/null
aws s3api put-bucket-policy --bucket $BUCKET --policy file://policy.json
aws s3api get-bucket-policy --bucket $BUCKET --query Policy --output text | python3 -m json.tool | head

# 3) Allow test + Deny test (fill per project)
# ... project-specific curls / aws s3 cp ...

# 4) Cleanup
aws s3 rm s3://$BUCKET --recursive || true
aws s3api delete-bucket-policy --bucket $BUCKET || true
aws s3api delete-bucket --bucket $BUCKET

19. Industry story bank (reuse the pattern)

Each project above uses one industry story. Use the same policy pattern in these other industries without rewriting the JSON from scratch — only change the bucket name, principal, and Condition values.

• Healthcare (Priya Nair, Apollo-style clinic): patient PDFs — prefer SSE-KMS + OrgID + MFA delete.
• Fintech (Arjun Mehta, UPI wallet): statements — office IP + SecureTransport + CloudFront OAC for the customer portal.
• EdTech (Sofia Alvarez, online course): course videos — CloudFront OAC only; never public ACLs.
• Logistics (Kenji Watanabe, fleet app): GPS dumps — VPC endpoint only from the private subnet runners.
• Media (Fatima Khan, newsroom): raw footage — Object Lock COMPLIANCE + deny delete.
• Retail (Lucas Meyer, D2C brand): product images — public read for /images/* only; deny everything else.
• SaaS (Ananya Iyer, B2B CRM): tenant exports — ${aws:username} or ${aws:PrincipalTag/tenant} prefixes.
• Government (Rahul Deshmukh, state portal): RTI archives — OrgID + MFA + Object Lock.

20. AccessDenied debugging flowchart

1. Read the error code and the request ID. Save both.
2. Confirm you are calling the right bucket and region.
3. Check Block Public Access if the principal is * or a service that looks public.
4. Decode the policy: is there an explicit Deny that matches? Deny wins.
5. Check Condition keys: SecureTransport, SourceVpce, SourceIp, PrincipalOrgID, encryption headers.
6. For KMS: does the key policy allow the caller? Bucket policy alone is not enough.
7. For CloudFront: is OAC present and the distribution id matching?
8. For VPC: are you really going through the endpoint (no public IP leak)?
9. Simulate in IAM Policy Simulator, then re-test with CLI from the real path.
10. Only then open a support case with the request id and a redacted policy.

21. What good looks like in a PR review

• Policy JSON validates and is indented.
• Every Statement has Sid, Effect, Action, Resource.
• No Principal:* with write actions unless BPA and a Deny fence exist.
• Allow test and Deny test are documented with expected output.
• Cleanup steps will not strand Object Lock or KMS keys.

Revision, interview and comparison cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.