Keep a bucket private while sharing a website — S3 and Block Public Access and CloudFront

Your goal

Plan public website delivery without making the source bucket public.

Why this matters

A site needs visitors to read its pages, but the team wants the S3 source kept private. You will keep public access blocked and give only the delivery service the access it needs.

Words you will use

Block Public Access helps prevent public S3 permissions. An origin is where a delivery service gets content. Origin access control lets CloudFront sign requests to a suitable S3 origin.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Choose a private default

A teammate suggests disabling every public-access safeguard before understanding the website design. Choose the safer starting point.

How should the bucket begin?

Private, with Block Public Access enabled.

Keep the bucket private while designing the intended access path. Block Public Access settings can apply at multiple levels, with the most restrictive combination affecting public access. Review the effective settings together.

The storage starts with protection against public permissions.

Private bucket + effective public-access safeguards

2. Let the delivery service read

Visitors should use CloudFront, which reads from a regular S3 bucket origin. The bucket itself should stay private. Choose the suitable access design.

What should you configure?

CloudFront origin access control and a narrowly scoped bucket policy.

Use origin access control with a supported S3 bucket origin and limit the bucket policy to the intended distribution. An S3 website endpoint has different behavior and does not support this same private-origin setup.

CloudFront has the specific access needed to fetch content.

Visitor → CloudFront → authorized private S3 origin

3. Test both sides of the boundary

The public page loads through CloudFront. You also need to know that the source bucket has not become an unintended public route. Choose the verification.

What should you test?

Public delivery works while unauthorized direct bucket access is denied.

Test the allowed route and a denied route. A successful page load alone does not prove the bucket is private. Check effective permissions and use harmless sample content when verifying access behavior.

The website works and the private storage boundary is checked.

Allowed delivery succeeds; unauthorized origin request fails

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.