how to write an S3 bucket policy that blocks public access

TL;DR

S3 Block Public Access is good, but a bucket policy with an explicit deny on public reads is the belt and suspenders. Add a policy statement that denies s3:GetObject to everyone when the request comes from outside your conditions. Test it from an anonymous session before you call it done.

The query

how to write an S3 bucket policy that blocks public access

Use this when

• You store private data in S3 and want public access impossible, not just unlikely
• An audit requires an explicit deny, not just the absence of an allow
• You want protection that survives someone disabling Block Public Access by mistake
• You are writing a baseline bucket policy for every new bucket

Not for

• Static website hosting or public asset buckets; those need public reads by design
• CloudFront origin access; that uses its own identity mechanism
• Fixing an already-public bucket that leaked data; lock it down and rotate what leaked

Steps

1. Turn on S3 Block Public Access for the bucket first. Set all four block settings to true as the outer guardrail. Expected output: the console or CLI shows all four settings enabled.
2. Write the deny statement. Add a policy statement with Effect Deny, Principal "", Action s3:GetObject (and s3:GetObjectVersion if versioned), on the bucket ARN plus /, with a condition that matches public access (aws:PrincipalIsAWSService false is not the trick; the standard approach is denying when aws:PrincipalType or simply denying all unauthenticated reads via a NotPrincipal scoping to your account). Expected output: a policy document saved in your repo.
3. Apply it with the CLI. Run the put-bucket-policy command with your JSON file and confirm it applies cleanly. Expected output: the command succeeds and get-bucket-policy returns your policy.
4. Test anonymous access. From a session with no AWS credentials, try fetching an object URL; it must be denied. Expected output: AccessDenied on the anonymous request.
5. Test your real consumers still work. Your apps, CI, and data pipelines should read fine through their IAM roles. Expected output: all legitimate reads succeed, only anonymous ones fail.
6. Add it to your bucket baseline. Every new bucket gets this policy via your IaC module so nobody has to remember. Expected output: new buckets created from the module carry the deny policy automatically.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_m4Miz5r-MNHynyreeyaVog