A new bucket is private: nobody outside your account can read anything in it. On top of that, four Block Public Access switches stop anyone from making it public by accident. All four start on.
| Switch | What it does while on |
|---|---|
BlockPublicAcls | refuses old-style public permissions on objects (ACLs) |
IgnorePublicAcls | ignores any such permissions that exist |
BlockPublicPolicy | refuses a bucket policy that would make the bucket public |
RestrictPublicBuckets | ignores such a policy if one exists |
A website must be readable by anyone, so a website bucket turns off the last two. The first two stay on: this course never uses ACLs.
s3api
These switches are a bucket setting, and bucket settings live in aws s3api. Where aws s3 is a friendly layer for moving files, s3api has one command for each operation of the S3 API, with every setting it has. Its parameters name the bucket with --bucket, without s3://.
aws s3api get-public-access-block --bucket monster-market-1bifmo{
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"IgnorePublicAcls": true,
"BlockPublicPolicy": true,
"RestrictPublicBuckets": true
}
}Changing the switches
aws s3api put-public-access-block --bucket monster-market-1bifmo --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=false,RestrictPublicBuckets=falseput- writes a setting and get- reads it back. The value is written as Name=value pairs separated by commas, with no spaces. Give all four: any you leave out turn off.
Turning the switches off makes nothing public yet. It only allows a policy that does, which is the next lesson.