Amazon S3 — buckets and public objects

Prerequisites

Before you begin, ensure you have the following:

• An AWS account with permission to create S3 buckets and edit bucket policies (for example s3:CreateBucket, s3:PutBucketPolicy, and object write actions).
• Comfort using the S3 console in a non-production account or sandbox, because you will briefly allow public read access.

Create an S3 bucket

Bucket names are globally unique and DNS-like; pick a name you control, for example my-company-assets-dev.

1. Sign in to the AWS Management Console and open S3.

2. Choose Create bucket.

   

3. Under General configuration, type a unique Bucket name and choose an AWS Region.

   

4. Under Object Ownership, keep ACLs disabled (recommended) unless you have a legacy workflow that requires ACLs.

   

5. To follow this tutorial’s public object URL test, clear Block all public access and acknowledge the warning. This exposes only what your bucket policy explicitly allows—still verify you are not uploading sensitive data.

   

6. Leave other defaults unless your organisation requires encryption or versioning from day one, then choose Create bucket.

Upload objects

1. Open the bucket from the bucket list.

2. Choose Upload and add one or more files (for example a PNG or JPEG).

   

3. Review permissions and properties, then choose Upload at the bottom of the wizard.

   

Configure a public read bucket policy

1. Stay in the bucket and open the Permissions tab.
2. Scroll to Bucket policy and choose Edit.

3. Paste a policy that allows anonymous s3:GetObject on all objects in the bucket. Replace your-bucket-name with your bucket name (the ARN must match exactly).

   Bucket policy (JSON)

   Copy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": "*",
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::your-bucket-name/*"
       }
     ]
   }

4. Save the policy. If the console reports errors, confirm the JSON is valid and the bucket name in the ARN matches.

Test the object URL

1. Open the Objects list inside the bucket.
2. Select an object you uploaded.

3. Under Object URL, copy the HTTPS link or open it in a new tab.

   

4. When the policy is correct, the image or file loads without signing in. You can embed that URL in HTML <img src="..."> for static marketing pages, or migrate the same objects behind CloudFront later.

   

Explore more S3 capabilities

After you are comfortable with buckets and policies, experiment with features that matter for operations and cost:

• Versioning — retain multiple variants of an object and recover from accidental overwrites.
• Server access logging — record request metadata to another bucket for auditing.
• Static website hosting — serve index.html error documents from a website endpoint (often combined with CloudFront).
• Lifecycle rules — transition objects to cheaper storage classes or expire them on a schedule.

Related in this series