September 26, 2026 路 #10
The bucket that answered to anyone
This bucket stores customer uploads. What is the bug in the resource?
resource "aws_s3_bucket" "uploads" {
bucket = "acme-customer-uploads"
}
resource "aws_s3_bucket_acl" "uploads" {
bucket = aws_s3_bucket.uploads.id
acl = "public-read"
}Next puzzle in UTC
One try. The first answer sticks.
How to fix it
public-read is an anonymous download grant. Enable the four public access block settings and use a bucket policy or presigned URLs instead of an ACL.
acl = "public-read" is a grant to AllUsers. Combined with no aws_s3_bucket_public_access_block, objects in this bucket are world-readable if the account still allows ACLs. Customer uploads do not belong on that setting. CloudFront origin access control does not need a public ACL. It uses a bucket policy that names the distribution.
AWS now defaults new buckets to "Bucket owner enforced," which disables ACLs. If your account still has ACLs enabled, this resource turns a private bucket into a public one the moment apply succeeds.
Fix
resource "aws_s3_bucket_public_access_block" "uploads" {
bucket = aws_s3_bucket.uploads.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
Delete the ACL resource. Hand out s3:GetObject with presigned URLs that expire, or with a bucket policy limited to one CloudFront origin.