S3 Bucket Policies: Public vs Private File Access Explained
Understand S3 and Cloudflare R2 bucket policies for public and private file access. Learn IAM roles, presigned URLs, and the principle of least privilege with examples.
Configuring S3 and R2 bucket policies correctly is critical to prevent accidental data leaks while ensuring authorized downloads function seamlessly.
The Principle of Least Privilege
By default, all cloud object storage buckets should have Block Public Access enabled. Individual files should only be exposed via CloudFront/Cloudflare CDN distributions or generated presigned URLs.
Download our sample file to test private bucket retrieval policies with S3 SigV4 authentication.
Download 1MB TXT Sample →Example: Read-Only Public Bucket Policy for CDN Origins
If your bucket is dedicated to serving static public assets via a custom domain:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowPublicReadForAssets",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-public-bucket/*"
}
]
}
Restricting Access to Cloudflare CDN (R2 Origin Access)
To ensure users cannot bypass your CDN and access your storage origin directly:
- In Cloudflare R2, navigate to Settings > Custom Domains.
- Connect your custom subdomain (e.g.,
cdn.example.com). - Turn off R2.dev public URL access. All traffic is now routed through Cloudflare's WAF and caching rules.
Nguyen Dai Long
AuthorBackend Lead • Distributed Systems & Cloud Edge Architecture Specialist
4+ years designing high-throughput file ingestion pipelines, database architectures, and distributed edge storage on Cloudflare R2 & AWS S3. Founder of FileDummy and the NDL Ecosystem.
Was this article helpful?
Click Like to support the author and help other developers discover this guide.
Engineering Discussion & Feedback (0)
Share benchmark results, report edge cases, or ask technical questions.
No comments yet. Be the first developer to start the discussion!
Frequently Asked Questions
Should I ever make an S3 bucket fully public?â–¾
Only for genuinely static public assets that require no access control — like open-source CDN assets or public sample files. Never make buckets containing user data, PII, or financial records public. Misconfigured public buckets are among the most common causes of cloud data breaches.
What is the difference between a bucket policy and an IAM policy?â–¾
Bucket policies are resource-based policies attached to the bucket controlling access from any AWS account. IAM policies are identity-based attached to users and roles controlling which AWS resources that identity can access. Both must allow access for cross-account requests to succeed.
How do I block all public access to an S3 bucket?â–¾
Enable all four Block Public Access settings in the S3 console. These settings override bucket policies and ACLs that would otherwise make objects public — a safety net against accidentally misconfigured policies.