S3 permissions, ACLs and CORS: a 2014 experiment
Historical notes on the confusing overlap of S3 console permissions, bucket ACLs and CORS. The public-access commands are not a security template.
I do like AWS S3, but on the topic of policy/security languages, IIUC Amazon have fecked up by having THREE of them.
- permissions Web UI
- policy
- CORS configuration
What to add anonymous public listing? You could:
- Click “Add more permissions”
- On the Grantee drop down box, select Everyone (not sure why I’m called hendry60 and “me”)
- Ensure listing is selected and Save
Or using the AWS cli:
aws s3api put-bucket-acl --bucket BUCKET_NAME --acl public-read