How do I secure a public-facing S3 bucket without blocking my web application?

All answers to this question.

You should never have a "Public" S3 bucket in a professional environment. The industry-standard way to handle this is to put an Amazon CloudFront distribution in front of your bucket. You then use an Origin Access Control (OAC) or Origin Access Identity (OAI) to allow CloudFront to fetch the files. This way, you can keep the S3 bucket completely private (blocking all public access), and only the CloudFront service can "see" the files to serve them to your users. This also provides the benefit of edge caching, making your site much faster globally while satisfying all security audits.

   Answered 2025-11-05 by Angela Martinez

Are you using a specific Bucket Policy right now, or are you relying on ACLs? ACLs are generally discouraged now. Have you tried writing a policy that only allows access from your specific web server's IP address as a temporary fix?

   Answered 2025-11-07 by Donald Harris

• Donald, I was using ACLs, which I now realize is the old way. I tried the IP restriction, but since our users come from all over, it didn't work for the assets. Angela's suggestion of using CloudFront with OAC seems like the most robust way to fix the security warnings while keeping the site functional.

     Commented 2025-11-08 by Kimberly Scott

Definitely use CloudFront. It’s a bit more setup initially, but it fixes the "Public Bucket" security flag permanently and protects you from S3 traversal attacks.

   Answered 2025-11-10 by Thomas Wright

• Exactly. Plus, CloudFront allows you to add a Web Application Firewall (WAF) later on if you need to block specific bots or countries, which you can't do with just a raw S3 bucket.

     Commented 2025-11-12 by Angela Martinez