Interactive concept model

S3 anonymous access experiment

Test policy scope and public-read restrictions.

Predict it. Test it. Change one thing.

Local educational model. No account or cloud charges. Nothing is deployed to AWS.

Anonymous index.html requestRestrictPublicBuckets is enabledPolicy Resource covers objects with /*Policy also contains a matching explicit deny

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::lesson-assets/*"
    }
  ]
}

Assumes the object exists and the policy has already been stored. BlockPublicPolicy controls submission of public policies; RestrictPublicBuckets controls the public read modeled here. KMS, ACLs and endpoint policies are outside this model.

sim.shahriarlabs.com · Free to explore

Try this learning loop

State a prediction before changing the controls. Identify which assumption changes the result, reset and test a second case. These deliberately small models explain one mechanism at a time.

Continue learning

Object storage