How do you keep an S3 bucket from being exposed publicly, and how do you grant your services access to it?

New buckets are private by default. Keep them private with Block Public Access, and give your services access through IAM roles.

Block Public Access is a safety switch. It is on by default for new buckets, and you can also turn it on for the whole account. It overrides any bucket policy or ACL (access control list: an older way to give access to a bucket or object) that would make data public. So a mistake in a policy cannot make your data public.

ACLs are off by default. The "bucket owner enforced" Object Ownership setting turns them off. This leaves IAM policies and bucket policies as the only way to control access.

Give your own services access through their IAM roles. Use least-privilege policies: each role gets only the actions and buckets it needs.

Use a bucket policy (rules attached to the bucket itself) for these cases:

• Access from another AWS account.
• Access from CloudFront through origin access control (OAC).
• Rules like "deny any request that does not use TLS".

S3 encrypts new objects at rest by default with SSE-S3 (keys that S3 manages). Use SSE-KMS (keys in AWS Key Management Service) if you need control and an audit log for each key.

To share public files, serve them through CloudFront or pre-signed URLs (links that give temporary access). Do not open the bucket to the public.