How to make an S3 bucket or file public (and safer ways to share it)

New S3 buckets are private, and since April 2023 they also block public access and have ACLs turned off from the start. So the old one-click way, making a file public with an ACL, doesn't work on them any more. Making files public now takes two steps: allow public access on the bucket, then add a bucket policy that grants it.

Before you do, two things worth knowing. Anyone who has or guesses a public file's URL can download it, as often as they like, and you pay for every download. And there's often a better tool for the job:

• A few files for a few people: a link that expires, and the bucket stays private.
• A website: CloudFront in front of a private bucket, which also gives you HTTPS and your own domain. See fixing CloudFront 403 errors from S3 for how the pieces fit.

In the AWS console

1. Open S3 → General purpose buckets, click the bucket, and open the Permissions tab.
2. Under Block public access (bucket settings), click Edit. Clearing Block all public access works, but you only need to clear the last two settings, the ones about bucket and access point policies; leaving the two ACL settings on is safer. Click Save changes and type confirm.
3. Under Bucket policy, click Edit, paste this with your bucket's name, and click Save changes:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicRead",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

To make only part of the bucket public, narrow Resource: arn:aws:s3:::my-bucket/public/* for one folder, or arn:aws:s3:::my-bucket/downloads/brochure.pdf for one file.

The files are now at addresses like https://my-bucket.s3.us-east-1.amazonaws.com/downloads/brochure.pdf, with your bucket's region in the middle. Each file's page in the console shows its Object URL.

Leave s3:ListBucket out unless you want everyone to be able to list every file name in the bucket, too.

If the settings won't change: S3 applies the strictest of the bucket's and the account's Block Public Access settings, so if the account blocks public access, the bucket's settings make no difference. The bucket's page says so when it does. The account-wide settings are under Account and organization settings in the S3 menu; turning them off affects every bucket, so check the others first. In an AWS Organization, they may be set by the organization, and only its administrators can change them.

With the AWS CLI

aws s3api put-public-access-block --bucket my-bucket \
  --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=false,RestrictPublicBuckets=false"

aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json

where policy.json holds the policy above. Then check what S3 thinks:

aws s3api get-bucket-policy-status --bucket my-bucket

"IsPublic": true means it's public. If put-bucket-policy fails with Access Denied, Block Public Access is still on somewhere. The account's settings:

aws s3control get-public-access-block --account-id 111122223333

Hosting a website straight from S3

The bucket's Properties tab has Static website hosting, which serves index.html for folder URLs and a custom error page. It needs the bucket to be public, as above, and its website address (http://my-bucket.s3-website-us-east-1.amazonaws.com, or with a dot before the region in some regions) only works over plain HTTP. For HTTPS, put CloudFront in front.

Turning it off again

Delete the bucket policy statement and turn Block all public access back on. Files someone has already downloaded are out of your hands, so it's worth checking now and then which buckets are public.

Or in Cloud GUI

The free checkup lists every bucket that's public through its bucket policy, so you can confirm the one you opened is the only one, and the buckets where Block Public Access is off and a policy change could make them public by mistake. Cloud GUI's Files page lists every bucket in every region, so you can check what's in one before you open it up; with editing turned on (Pro), you can upload files to it too. Cloud GUI doesn't change bucket settings: that part stays in AWS. The IAM policy explainer has a "Public website bucket" sample that shows what a policy like the one above allows, with the public access flagged.