AWS S3 Bucket Policy Deny + Open With Signed URL - amazon-s3

Question

I have a public S3 bucket and I want to make all the files within folderA to be access via signed URL but remain folderB access publicly.
Below is the folder structure:
- Bucket (public)
- folderA <-- want to be access via Signed URL
- file1
- file2
- folderB <-- remain public
- file3
- file4
I tried insert the policy below into the bucket. However, after I inserted the policy, the files is totally unable to access publicly and with signed URL too.
{
"Version": "2012-10-17",
"Id": "Policy1596533716384",
"Statement": [
{
"Sid": "Stmt1596533705733",
"Effect": "Deny",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:GetObjectAcl"
],
"Resource": "arn:aws:s3:::bucket/folderA/*"
}
]
}
What configure is missing from the bucket policy ?
Any opinion is appreciate. Thanks.

Answer 1

All objects in Amazon S3 are private by default.
To make the contents of folderB public, you would need to add a Bucket Policy similar to:
{
"Version": "2012-10-17",
"Id": "Policy1596533716384",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::bucket/folderB/*"
}
]
}
This makes everything in folderB public.
As for making everything in folderA accessible via pre-signed URLs, your application would be responsible for generating the pre-signed URLs. Typically, the flow would be:
A user authenticates to your application
The user requests access to a private object (in your case, this would be something in folderA)
The application would check whether the user is entitled to access this object
If they are entitled to access the object, then the application would generate a pre-signed URL, which provides time-limited access to the private object
The application would give this signed URL to the user, either as a link or as part of an HTML page (eg in a <img> tag)
The user's browser would access the object via the provided URL. S3 would validate that the URL is correctly signed and that the time period has not expired. If so, it grants access to the private object.
Note: When you click the Open button in the Amazon S3 console, the console is generating a pre-signed URL to allow you to access a private object. This pre-signed URL is generated when you click the button and it will only work if your IAM User has been granted access to the object. That is, it uses the permissions of the person using the console to generate a pre-signed URL.
Your policy is saying "Deny everybody access to folderA". This includes the IAM User that is using the console, which is why they are unable to access the file, even when using a pre-signed URL. The pre-signed URL only has access to objects that are available to the IAM User that generated the pre-signed URL.