Chapter 4 of 5 · 2 min
How do I access an S3 bucket privately?
SHORT ANSWER
A new bucket is already private, at no cost. Block Public Access is on from the start, and nobody outside your account can read a file until you allow it by name.
The lesson 5 film is on chapter 1.
Keeping it that way
- Leave Block Public Access, the keep-it-private switch, on. It is the one setting that matters most.
- Give access by name: permissions on your own people and programs, a bucket policy for anyone in another account, each limited to the folders they need.
- For outsiders, use links that expire rather than opening the bucket.
- For your own servers inside Amazon, a VPC endpoint, a private side entrance, keeps traffic off the public internet, and a bucket rule can refuse anything that arrives another way.
Knowing who read what
Turn on access logging. It is free apart from the rent on the log files, and it is the only record of who opened which file.
The bucket stays private. The links do the travelling.
S3 bucket policy examples for team file access has every rate and the steps.
NEXT · CHAPTER 5 OF 5How do I upload without the console?Drag and drop is possible. It just is not built in.The same bucket, two ways
Compare with the AWS Console See the steps to open, share and give a colleague access in the AWS Console and in BucketDesk, side by side.