How to Create an AWS S3 Bucket and Make It Public Safely

To create an AWS S3 bucket, open Amazon S3, choose a unique bucket name and AWS Region, keep Object Ownership set to ACLs disabled, and create the bucket. New S3 buckets are private by default. If a website file must be public, grant only s3:GetObject through a narrow bucket policy—never upload passwords, backups, customer records, or other private data to a public bucket.

This guide shows both parts: creating a private S3 bucket safely and, only when required, making selected bucket objects publicly readable.

Before you make an S3 bucket public

Most buckets should stay private. Applications can access private objects with IAM roles, signed URLs or CloudFront. Public access is normally needed only for files that everyone is meant to read, such as a public website asset.

• Do not make an entire bucket public for a single download.
• Do not store secrets or personal information in a public bucket.
• Use a separate bucket for public files instead of mixing public and private data.
• Use AWS IAM Access Analyzer and S3 access information to review exposure.

Step 1: Open Amazon S3

Sign in to the AWS Management Console, search for S3, and open the service. Choose Create bucket.

Step 2: Choose the bucket name and Region

Enter a globally unique bucket name. Use lowercase letters, numbers and hyphens. Select the AWS Region closest to the application or users, while considering your organisation’s data-location requirements.

Step 3: Keep ACLs disabled

Under Object Ownership, keep ACLs disabled (recommended). Bucket policies and IAM policies are easier to review than separate object ACLs.

Step 4: Create the private S3 bucket

Leave Block all public access enabled when creating the bucket. Review the remaining settings, enable default encryption if it is not already shown as enabled, and choose Create bucket. You now have a private S3 bucket.

Open the bucket and use Upload to add a test file. A private object URL will return AccessDenied unless the request is authorised. That is expected.

How to make an S3 bucket public safely

Continue only when every object covered by the policy is intended for public reading. The following policy permits downloads but does not allow anonymous uploads, changes or deletion.

1. Change Block Public Access for this bucket

Open the bucket, choose Permissions, find Block public access (bucket settings), and choose Edit. Clear the setting that prevents the required public bucket policy, acknowledge the warning, and save.

This removes a safety guard; it does not grant public access by itself. S3 evaluates Block Public Access at the organisation, account, bucket and access-point levels and applies the most restrictive effective combination. A bucket-level change therefore cannot override a stricter organisation or account policy.

2. Add a public-read bucket policy

Under Bucket policy, choose Edit. Replace YOUR-BUCKET-NAME with the exact bucket name:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadObjects",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
    }
  ]
}

Save the policy. The bucket may now display a Publicly accessible warning. That warning should appear only when public access is intentional.

Limit public access to one folder

To expose only objects under a folder such as public/, narrow the resource:

"Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/public/*"

Objects outside that prefix remain private unless another policy grants access.

Safer alternatives to a public S3 bucket

Public S3 access is not required for many sharing and website-delivery jobs. Choose the narrowest method that matches the audience and duration.

Never grant anonymous s3:PutObject, s3:DeleteObject or wildcard s3:* permissions. Public write access lets unknown users upload, replace or delete data.

Create an S3 bucket with the AWS CLI

After installing and configuring the AWS CLI, create a bucket in ap-south-1:

aws s3api create-bucket 
  --bucket YOUR-BUCKET-NAME 
  --region ap-south-1 
  --create-bucket-configuration LocationConstraint=ap-south-1

For us-east-1, omit --create-bucket-configuration. Keep the bucket private unless public access is part of the design.

Check the bucket-level public access block:

aws s3api get-public-access-block --bucket YOUR-BUCKET-NAME

Test the public object URL

Open an uploaded object and choose Copy URL. Test it in a private browser window where you are not signed in to AWS. A public object should load without AWS credentials.

Fix S3 AccessDenied after adding the policy

If the URL still returns AccessDenied, check these points:

• The policy bucket name and object path are correct.
• The policy resource ends with /* for objects.
• Bucket-level and account-level Block Public Access do not reject the policy.
• An organisation service control policy or permissions boundary is not blocking the change.
• The uploaded object is inside the prefix allowed by the policy.
• For SSE-KMS objects, do not expect anonymous users to decrypt with a private KMS key.

How to make the bucket private again

Remove the public-read statement from the bucket policy and enable Block all public access again. Test the object URL from a private browser window; it should return AccessDenied. Also review any CloudFront distribution, access point or other policy that may provide access separately.

Frequently asked questions

Are new S3 buckets public by default?

No. New S3 buckets and objects are private by default, and AWS applies public-access protections unless an administrator deliberately changes them.

Can I make one S3 object public?

With ACLs disabled, use a bucket policy restricted to the exact object key or a dedicated public prefix. A time-limited presigned URL is usually better when only selected people need temporary access.

Does a public bucket allow uploads?

Not with the read-only policy in this guide. It grants only s3:GetObject. Anonymous uploads would require a separate write permission and should not be enabled.

Official references

• AWS: Creating a general purpose bucket
• AWS: Blocking public access to S3 storage
• AWS: Bucket policy examples

Administrators using object storage with collaboration platforms should also review our Nextcloud 34.0.3 maintenance update guide before upgrading a production server.

You now know how to create an AWS S3 bucket, upload an object and make only the intended content public. Keep private access as the default and review every public policy before storing new data.