Security
Public S3 buckets: why private-by-default is safer
A public bucket is easy to demonstrate and difficult to govern. Most application uploads, backups and internal artifacts should start private, with public delivery added only where the data is intentionally meant for anonymous access.
Public access changes the threat model
A private object requires an authenticated request or a deliberately signed temporary URL. A public object can be fetched by anyone who learns or guesses its address, including crawlers and automated scanners.
Object keys are identifiers, not passwords. Hiding sensitive data behind a complicated-looking key is not an access-control strategy.
Backups should not be public
Backup archives can contain databases, configuration files, customer data and credentials. They should be protected by scoped storage credentials and, where appropriate, additional client-side encryption.
A backup system that needs anonymous HTTP download is a design warning. Recovery staff can authenticate during a restore.
Use presigned URLs for temporary sharing
Presigned URLs grant a specific operation for a bounded period without disclosing the underlying S3 secret. They are useful for uploads, downloads and support workflows where the recipient should not receive permanent bucket credentials.
Choose expiry times based on the operation and remember that anyone who obtains the URL during its validity can normally use it. Treat the URL itself as temporary sensitive data.
Static public content deserves a delivery design
A website asset bucket may legitimately feed public images or downloads. Even then, consider a CDN, application gateway or narrowly scoped read policy so upload and administrative operations remain private.
Separate public content from private customer objects so access rules stay simple and auditable.
Test from an unauthenticated client
After configuration changes, request representative object URLs without credentials. Private objects should return an authorization failure and never return the object bytes.
Automate this negative check when possible. A policy review can miss an ACL or inherited setting that a real anonymous request exposes immediately.