S3 will automatically block public access and disable ACL for new buckets(aws.amazon.com)
aws.amazon.com
S3 will automatically block public access and disable ACL for new buckets
https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-s3-automatically-enable-block-public-access-disable-access-control-lists-buckets-april-2023/
6 comments
With the amount of information leaks that have occurred from S3 buckets being public, I'm surprised this wasn't fixed a decade ago.
I've never worked at AWS, but I have worked on smaller systems where people depended on defaults. Speaking first hand, it is EXTREMELY difficult to get changes to defaults shipped on a system with as much usage as S3.
You are, inevitably, going to break someone's workflow for a reason that you cannot possibly fathom. They are going to be unhappy. At least one of them is going to come across your boss' boss' desk and they're going to wonder if this change is _really_ necessary.
Every incentive, even with this default behavior being bad, is to leave it the way it is.
Respect to the AWS people that got this across the line.
You are, inevitably, going to break someone's workflow for a reason that you cannot possibly fathom. They are going to be unhappy. At least one of them is going to come across your boss' boss' desk and they're going to wonder if this change is _really_ necessary.
Every incentive, even with this default behavior being bad, is to leave it the way it is.
Respect to the AWS people that got this across the line.
Both were made default at their inception, at least on the console.
You need to remember the S3 API is from 2006 and Amazon probably measure how many buckets are created with these 17 year old defaults and then actually stay and rely on these defaults.
You need to remember the S3 API is from 2006 and Amazon probably measure how many buckets are created with these 17 year old defaults and then actually stay and rely on these defaults.
Public access by default was a boneheaded decision from the very beginning. Even in 2006 it was already well-known for decades how public anonymous access to things could lead to problems. All they needed to do was provide a checkbox to enable public access.
People who say this should have been done earlier, what is the use case where you considered this a problem? This was already the console UI default for manually created new buckets. Was it a problem with using CloudFormation or APIs to create buckets?
Perhaps you're familiar with the saying: "Make something idiot-proof and someone will make a better idiot."
Don't get me wrong; these are good settings and I applaud AWS for making them. They certainly will reduce the chances of people accidentally making a bucket public. I'm just sad because I know there are those intentionally making a bucket public when they shouldn't.
Sometimes it's just easier to chmod 777 and watch all your access problems disappear.
Don't get me wrong; these are good settings and I applaud AWS for making them. They certainly will reduce the chances of people accidentally making a bucket public. I'm just sad because I know there are those intentionally making a bucket public when they shouldn't.
Sometimes it's just easier to chmod 777 and watch all your access problems disappear.
We wrote a post on this and some of the nuances/discrepancies for these S3 settings: https://www.cloudquery.io/blog/finding-enabled-s3-acls-and-d...
Better late than never.
At long last