S3 Block Public Access: the setting that overrides everything

TL;DR

Run IAM Access Analyzer for S3 to list buckets with public or shared access. If someone needs an object, generate a presigned URL with a short expiry instead of making the object public.

Steps

1. Turn on Block Public Access at the account level: all four sub-settings.
2. Leave it on for every new bucket unless you have a written reason not to.
3. If someone needs an object, generate a presigned URL with a short expiry instead of making the object public. Presigned URLs work with the block in place.
4. Run IAM Access Analyzer for S3 to list buckets with public or shared access.
5. Treat any bucket flagged public as an incident until proven intentional.
6. If a bucket must serve public content, front it with CloudFront and keep the bucket itself private.

When to use

You are seeing this: S3 Block Public Access, at the account level and the bucket level, blocks public access even when a bucket policy or ACL would allow it. Use this skill when you run into "S3 Block Public Access: the setting that overrides everything".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Covers the S3 Block Public Access feature: account-level and bucket-level settings that override policies and ACLs, plus presigned URLs as the safe sharing mechanism and IAM Access Analyzer for S3 for review. Verified against the live S3 user guide. https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html