World A3: The Mall's Roads

S3 buckets and Block Public Access

You will learn: to keep files in S3, and why the master lock stays on.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Shoppers should see Kedai Kancil’s menu photos. The same storeroom also holds the order list, with phone numbers. Open the whole storeroom to the public?

Watch

An is a storeroom for files. It lives in one Region. Its name must be unique, so pick your own. Watch the official examples.

bash

aws s3 mb s3://amzn-s3-demo-bucket

make_bucket: s3://amzn-s3-demo-bucket

aws s3 ls

2013-07-11 17:08:50 amzn-s3-demo-bucket

2013-07-24 14:55:44 amzn-s3-demo-bucket2

Watch

is the storeroom’s master lock. New buckets get it on by default. Tap every lock that is on.

Tap every setting that is on.

0 of 4 found

Try it

Aina may read the menu bucket. Now she asks for a file in the orders bucket. Will AWS allow it?

Read the request and its policies. Will AWS say Allow or Deny?

The request

Who: Aina (IAM user)arn:aws:iam::111122223333:user/aina
Wants to: s3:GetObject
On: arn:aws:s3:::kedai-orders/2026-11-01.csv

Identity policy (key ring) · menu-reader

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": "s3:GetObject",

"Resource": "arn:aws:s3:::kedai-menu/*"

}

]

}

Your guess:

Predict

The master lock is on. Someone adds a bucket policy: “everyone may read”. What happens?

Check

Good storeroom habits, or risky? Swipe right for good.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Keep Block Public Access on for every bucket

You did it!

You can now keep files in S3 with the master lock on.

Go deeper (optional)

Deleting a bucket: aws s3 rb s3://amzn-s3-demo-bucket --force first deletes every file inside. Treat it as final, and check the name twice.

Real rep (optional), on a test account. Make a bucket and upload one file. Check the lock, then empty and delete it.