S3 security: Block Public Access, bucket policies, encryption

Sign in and set up variables:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$acct = aws sts get-caller-identity --query Account --output text
$myArn = aws sts get-caller-identity --query Arn --output text
$bucket = "saat-sec-$acct-ap-south-1-an"

1Block Public Access for the whole account

Paste this whole block:

aws s3control put-public-access-block --account-id $acct --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
aws s3control get-public-access-block --account-id $acct --query PublicAccessBlockConfiguration --output text

You should see this:

True    True    True    True

Now no bucket in this account can be made public, even by mistake. Real companies set this on day one, usually through an SCP so nobody can switch it off.

2Create the bucket with SSE-KMS by default

Paste this whole block:

aws s3api create-bucket --bucket $bucket --bucket-namespace account-regional --region ap-south-1 --create-bucket-configuration LocationConstraint=ap-south-1 | Out-Null
aws s3api put-bucket-tagging --bucket $bucket --tagging 'TagSet=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=17}]'
'{ "Rules": [ { "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms" }, "BucketKeyEnabled": true } ] }' | Set-Content enc.json
aws s3api put-bucket-encryption --bucket $bucket --server-side-encryption-configuration file://enc.json
Set-Content -NoNewline q3.csv "quarter,revenue`nQ3,1825000`n"
Set-Content salaries.csv "name,salary"
aws s3 cp q3.csv "s3://$bucket/reports/q3.csv"
aws s3 cp salaries.csv "s3://$bucket/private/salaries.csv"
aws s3api head-object --bucket $bucket --key reports/q3.csv --query "[ServerSideEncryption,BucketKeyEnabled]" --output text

You should see something like this:

upload: .\q3.csv to s3://saat-sec-111122223333-ap-south-1-an/reports/q3.csv
upload: .\salaries.csv to s3://saat-sec-111122223333-ap-south-1-an/private/salaries.csv
aws:kms True

Leaving out a key ID means S3 uses the AWS managed key aws/s3. The bucket key cuts KMS requests (and their cost) by using one short-lived data key per bucket instead of one KMS call per object.

3Create a reader role with no permissions

Paste this whole block:

@'
{
  "Version": "2012-10-17",
  "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "MY_ARN" }, "Action": "sts:AssumeRole" } ]
}
'@ -replace 'MY_ARN', $myArn | Set-Content reader-trust.json
$roleArn = aws iam create-role --role-name saat-report-reader --assume-role-policy-document file://reader-trust.json --tags Key=course,Value=saatvedha-aws Key=lesson,Value=17 --query Role.Arn --output text
aws configure set role_arn $roleArn --profile saat-reader
aws configure set source_profile saat-admin --profile saat-reader
aws configure set region ap-south-1 --profile saat-reader
Start-Sleep 15
aws sts get-caller-identity --profile saat-reader --query Arn --output text

You should see something like this:

arn:aws:sts::111122223333:assumed-role/saat-report-reader/botocore-session-1760951234

The saat-reader profile assumes the role using your saat-admin sign-in. The role has no IAM policy attached, so right now it can’t read anything. The 15-second pause gives IAM time to make the new role visible everywhere.

4Write the bucket policy

Paste this whole block:

@'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::BUCKET", "arn:aws:s3:::BUCKET/*"],
      "Condition": { "Bool": { "aws:SecureTransport": "false" } }
    },
    {
      "Sid": "ReaderGetReports",
      "Effect": "Allow",
      "Principal": { "AWS": "ROLE_ARN" },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::BUCKET/reports/*"
    }
  ]
}
'@ -replace 'BUCKET', $bucket -replace 'ROLE_ARN', $roleArn | Set-Content policy.json
aws s3api put-bucket-policy --bucket $bucket --policy file://policy.json
aws s3 ls "s3://$bucket" --endpoint-url http://s3.ap-south-1.amazonaws.com

The last command fails, and that is the point:

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: User: arn:aws:iam::111122223333:user/yourname.admin is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::saat-sec-111122223333-ap-south-1-an" with an explicit deny in a resource-based policy

Even you, an administrator, are refused over plain HTTP. The explicit Deny beats your AdministratorAccess.

5Test as the reader

Paste this whole block:

aws s3 cp "s3://$bucket/reports/q3.csv" - --profile saat-reader
aws s3 cp "s3://$bucket/private/salaries.csv" - --profile saat-reader

You should see this:

quarter,revenue
Q3,1825000
fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

The - at the end prints the file to the screen instead of saving it. The reader gets reports, decrypted through KMS, and nothing else.

✅ Checkpoint: Account-level Block Public Access shows True four times, objects are aws:kms with a bucket key, HTTP is refused even for you, and saat-reader can read reports/q3.csv but not private/salaries.csv.