S3 Bucket Security: Block Public Access, Bucket Policies, and Object Ownership

Two access control systems, one Block Public Access override

S3 has two ways to grant access to objects:

1. ACLs (Access Control Lists): object-level or bucket-level permissions using a predefined grant model (READ, WRITE, FULL_CONTROL). Legacy — AWS recommends disabling them.
2. Bucket policies: IAM-style JSON policies attached to the bucket. The right approach for all new configurations.

Block Public Access settings are a separate layer that sits on top of both. They prevent public access regardless of what ACLs or bucket policies allow.

The four flags in practice

resource "aws_s3_bucket_public_access_block" "main" {
  bucket = aws_s3_bucket.main.id

  block_public_acls       = true   # prevent new public ACLs
  ignore_public_acls      = true   # ignore existing public ACLs
  block_public_policy     = true   # prevent bucket policies granting public access
  restrict_public_buckets = true   # restrict existing public policy buckets
}

For any bucket that should not be publicly accessible, enable all four. For buckets hosting static websites or public assets where public access is intentional, disable them selectively.

Why all four matter:

• BlockPublicAcls alone: prevents new public ACLs but doesn't remove existing ones
• IgnorePublicAcls alone: disables existing public ACLs but someone could add new ones
• Together: prevents and negates public ACLs
• Same logic applies to the policy pair

Bucket policies: the correct way to grant access

# Grant read access to a specific IAM role
resource "aws_s3_bucket_policy" "main" {
  bucket = aws_s3_bucket.main.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowRoleAccess"
        Effect = "Allow"
        Principal = {
          AWS = aws_iam_role.app.arn
        }
        Action = [
          "s3:GetObject",
          "s3:PutObject"
        ]
        Resource = "${aws_s3_bucket.main.arn}/*"
      },
      {
        Sid    = "AllowListBucket"
        Effect = "Allow"
        Principal = {
          AWS = aws_iam_role.app.arn
        }
        Action   = "s3:ListBucket"
        Resource = aws_s3_bucket.main.arn  # ListBucket applies to bucket, not objects
      }
    ]
  })
}

ListBucket applies to the bucket ARN (without /*). GetObject and PutObject apply to objects (arn:*/*). A common mistake is using arn:.../* for ListBucket — it silently grants nothing because list operations target the bucket, not its contents.

Object ownership and ACL disabling

Modern S3 usage should disable ACLs entirely using Object Ownership settings:

resource "aws_s3_bucket_ownership_controls" "main" {
  bucket = aws_s3_bucket.main.id

  rule {
    object_ownership = "BucketOwnerEnforced"  # disables ACLs entirely
  }
}

BucketOwnerEnforced: ACLs are disabled. All objects in the bucket are owned by the bucket owner regardless of who uploads them. This is the recommended setting for new buckets — it simplifies access management and prevents cross-account upload confusion.

BucketOwnerPreferred: objects uploaded by other accounts are owned by the bucket owner if the requester includes bucket-owner-full-control canned ACL. Legacy support.

ObjectWriter (default): the uploading account owns the object. Can lead to situations where objects in your bucket are owned by another account and you can't delete them.

resource "aws_s3_bucket_versioning" "main" {
  bucket = aws_s3_bucket.main.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "main" {
  bucket = aws_s3_bucket.main.id

  rule {
    id     = "expire-old-versions"
    status = "Enabled"

    noncurrent_version_expiration {
      noncurrent_days = 30     # delete non-current versions after 30 days
      newer_noncurrent_versions = 3  # keep last 3 versions regardless of age
    }

    abort_incomplete_multipart_upload {
      days_after_initiation = 7   # clean up incomplete multipart uploads
    }
  }
}

Cross-account access: when bucket policy alone is sufficient

For same-account access, an IAM role's permission policy OR a bucket policy is sufficient. For cross-account access, both the IAM policy (in the requesting account) AND the bucket policy (on the bucket) must allow the action:

# Bucket in Account A — grant access to Account B role
resource "aws_s3_bucket_policy" "cross_account" {
  bucket = aws_s3_bucket.main.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        AWS = "arn:aws:iam::ACCOUNT_B_ID:role/DataProcessor"
      }
      Action   = ["s3:GetObject", "s3:ListBucket"]
      Resource = [
        aws_s3_bucket.main.arn,
        "${aws_s3_bucket.main.arn}/*"
      ]
    }]
  })
}

Account B's role also needs permission to call S3 in its own policy. Without the bucket policy, Account B's role can't access Account A's bucket even with full S3 permissions in their own IAM policy.