How can I set a bucket in Amazon S3 so all the files are publicly read-only by default?
2 Answers
You can set a bucket policy as detailed in this blog post:
http://ariejan.net/2010/12/24/public-readable-amazon-s3-bucket-policy/
As per @robbyt's suggestion, create a bucket policy with the following JSON:
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "AllowPublicRead",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::bucket/*"
]
}
]
}
Important: replace bucket
in the Resource
line with the name of your bucket.
-
When using official AWS CLI
arn:aws:s3:::bucket
also needs to be added to theResource
array. (So without the/*
.) I hope this helps others who were struggling with this like me.– silvenonFeb 18, 2015 at 16:03 -
My bad. This is needed only if you plan to
sync
, not just view the bucket.– silvenonFeb 18, 2015 at 16:05 -
7To support anonymous access through python's boto, in addition to setting this policy, I also had to grant
List
privilege toEveryone
in the Properties > Permissions section of the bucket. Jul 7, 2015 at 19:33 -
what is the rule of writeing Version? I am using current date 2017-11-16, it reports:Error: The policy must contain a valid version string Nov 16, 2017 at 10:11
-
1
Amazon provides a policy generator tool:
https://awspolicygen.s3.amazonaws.com/policygen.html
After that, you can enter the policy requirements for the bucket on the AWS console:
-
this is official document of <<Using Bucket Policies and User Policies>> docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html Nov 16, 2017 at 10:24
-
3Great link. Syntax is so complex they had to write a generator for it.– timboJun 12, 2019 at 23:41
-
aws s3 sync ./local-folder-name s3://remote-bucket-name --acl=public-read