All challenges
beginnerawss3security~9 min4 rounds

Your S3 Website Returns 403. Make the Bucket Public?

Objects in S3 return 403 and a teammate wants to turn off Block Public Access to fix it fast. Defend the right way to grant access.

the decision you defend

Your app gets 403 AccessDenied fetching objects from a private S3 bucket. A teammate says just turn off Block Public Access and make the bucket public so it works. Do you agree, and what do you do instead?

Sign in to startFree for everyone. Takes a few seconds.

the situation

Your web app started returning 403 AccessDenied when it loads files from an S3 bucket that has always been private. It worked in another environment, so something about access is misconfigured here.

context

Block Public Access is on for the account and the bucket. The app runs on AWS with its own IAM role. A teammate is under deadline pressure and says the simplest fix is to turn off Block Public Access and add a policy that allows everyone to read the bucket, so the 403 just goes away. The bucket also holds some files that were never meant to be shared.

How this challenge works

Take a position on the decision above and defend it. A senior-engineer AI will push back over up to 4 rounds. When you are done, you are scored against a verified rubric so you can see exactly what a complete answer covers - these are learning prompts, not gotchas.