With the block lifted, the bucket needs a policy that says who may read it. A policy is a JSON document made of statements. This one has a single statement:
json
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::monster-market-uqmqtl/*"
}]
}anyonePrincipal *
Effect Allow
s3:GetObjectAction
on
monster-market/*Resource
- Effect:
Allow(orDeny). - Principal: who.
"*"is anyone at all. - Action: which operation, written
service:Operation.s3:GetObjectis reading an object. Uploading (s3:PutObject), deleting and listing are not in it, so they stay denied. - Resource: which things, by ARN.
arn:aws:s3:::monster-market-uqmqtlis the bucket; with/*after it, every object in the bucket. - Version is always that date. It names the policy language, not your policy.
Attaching it
sh
aws s3api put-bucket-policy --bucket monster-market-uqmqtl --policy file://policy.jsonfile:// tells the CLI to read the parameter's value from a file, which beats typing JSON on one line. It works for any parameter.
sh
aws s3api get-bucket-policy-status --bucket monster-market-uqmqtlThe answer says "IsPublic": true. Anyone can now read every object in the bucket, and do nothing else with it.