Skip to main content

Public access via CLI & S3 clients

Toggling Public Access from the console has been retired. To let anyone read a bucket's objects over the internet, set a bucket policy that grants anonymous s3:GetObject, using any S3-compatible tool. This guide covers the two most common: the AWS CLI and the MinIO Client (mc).

Public access exposes objects to the internet

A public-read policy makes every matching object readable by anyone with the URL — no credentials required. Only do this for buckets meant to be public (a website, public downloads, a CDN origin). Never store secrets, backups or personal data in a public bucket.

Before you start​

You need two things, both from the console:

  • An access key — the Access Key ID + Secret Access Key pair. Create one under Access Keys.
  • The regional endpoint — shown on the bucket's Create / Settings page (e.g. the S3 endpoint for the bucket's region).

The examples below use these placeholders — substitute your own values:

PlaceholderMeaning
ENDPOINTThe regional S3 endpoint, e.g. https://<your-regional-endpoint>
BUCKETYour bucket name
AKID / SECRETYour access key ID and secret

Option A — AWS CLI​

Configure a named profile once, then apply a public-read policy.

# One-time: store the credentials in a profile
aws configure set aws_access_key_id     AKID    --profile vnetwork
aws configure set aws_secret_access_key SECRET  --profile vnetwork
aws configure set region                us-east-1 --profile vnetwork

Write the public-read policy to a file (public-read.json):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::BUCKET/*"
    }
  ]
}

Apply it — every S3 call needs --endpoint-url so the CLI talks to VNETWORK, not AWS:

aws --profile vnetwork --endpoint-url ENDPOINT \
  s3api put-bucket-policy --bucket BUCKET --policy file://public-read.json

Verify a public read works (no credentials):

curl -I ENDPOINT/BUCKET/path/to/object.jpg   # expect: HTTP/1.1 200 OK

Make it private again — remove the policy:

aws --profile vnetwork --endpoint-url ENDPOINT \
  s3api delete-bucket-policy --bucket BUCKET
Scope it down

To expose only one prefix instead of the whole bucket, narrow the Resource, e.g. arn:aws:s3:::BUCKET/public/*. You can add several statements for several prefixes.

Option B — MinIO Client (mc)​

mc wraps the same policy in one command. First register the storage account as an alias:

mc alias set vnetwork ENDPOINT AKID SECRET

Grant anonymous download (read-only) access:

mc anonymous set download vnetwork/BUCKET

Check the current setting and test a read:

mc anonymous get vnetwork/BUCKET             # -> "download"
curl -I ENDPOINT/BUCKET/path/to/object.jpg   # expect: HTTP/1.1 200 OK

mc policy levels: none (private), download (public read), upload (public write), public (read + write). Only use download for public content — upload/public let anyone overwrite your objects.

Make it private again:

mc anonymous set none vnetwork/BUCKET

To expose a single prefix instead of the whole bucket:

mc anonymous set download vnetwork/BUCKET/public

Serving public objects through a CDN​

For production public content, put a Multi-CDN domain in front of the bucket (the bucket is the origin). You get caching, TLS and a custom domain, and clients hit the edge instead of the storage endpoint directly.

See also​