Lab: a private, encrypted S3 bucket

Aim and what you need

The aim is to create object storage that is private by design and to prove it. Amazon S3 (Simple Storage Service) stores files as objects in buckets. Since 2023, new buckets start with Block Public Access on, ACLs (access control lists) disabled and SSE-S3 encryption, but you should still set and check each control explicitly, because older buckets and other tools may differ.

• An AWS account with an admin IAM user and MFA, plus a budget.
• AWS CLI v2. A small text file such as notes.txt to upload.
• A globally unique bucket name, for example <yourname>-lab-private-2026. About 30 minutes; costs are pennies for small files.

Steps

1. Create the bucket in your home region.
2. Turn on all four Block Public Access settings and enforce bucket-owner object ownership.
3. Set default encryption. This lab uses SSE-S3 (AES-256); to try SSE-KMS, change the algorithm to aws:kms and add a key ID.
4. Turn on versioning.
5. Add a bucket policy that denies any request not using TLS (Transport Layer Security).
6. Upload a file and create a pre-signed URL that expires after five minutes.

B=<yourname>-lab-private-2026
aws s3api create-bucket --bucket $B --region eu-west-2 --create-bucket-configuration LocationConstraint=eu-west-2
aws s3api put-public-access-block --bucket $B --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
aws s3api put-bucket-ownership-controls --bucket $B --ownership-controls 'Rules=[{ObjectOwnership=BucketOwnerEnforced}]'
aws s3api put-bucket-encryption --bucket $B --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"},"BucketKeyEnabled":true}]}'
aws s3api put-bucket-versioning --bucket $B --versioning-configuration Status=Enabled
aws s3api put-bucket-policy --bucket $B --policy '{"Version":"2012-10-17","Statement":[{"Sid":"DenyInsecureTransport","Effect":"Deny","Principal":"*","Action":"s3:*","Resource":["arn:aws:s3:::'$B'","arn:aws:s3:::'$B'/*"],"Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}'
aws s3 cp notes.txt s3://$B/notes.txt
aws s3 presign s3://$B/notes.txt --expires-in 300

How to verify

Read each setting back and confirm it matches what you set. Then test from the outside. Opening the plain object URL https://<bucket>.s3.eu-west-2.amazonaws.com/notes.txt in a private browser window should return Access Denied. The pre-signed URL should download the file, and the same URL should fail once five minutes have passed. Upload notes.txt again with a change, then list object versions to see both copies. In the console, the bucket should show "Bucket and objects not public", and IAM Access Analyzer for S3 should raise no public-access findings.

aws s3api get-public-access-block --bucket $B
aws s3api get-bucket-encryption --bucket $B
aws s3api get-bucket-versioning --bucket $B
aws s3api get-bucket-policy-status --bucket $B
aws s3api head-object --bucket $B --key notes.txt
aws s3api list-object-versions --bucket $B --prefix notes.txt

Troubleshooting and clean-up

• BucketAlreadyExists: names are global across all AWS customers. Add something unique.
• IllegalLocationConstraintException: for us-east-1 leave out the location constraint; for other regions it must match --region.
• Policy rejected: check the JSON quoting; it is easier to save the policy as policy.json and use --policy file://policy.json.
• Pre-signed URL denied at once: your computer clock may be wrong, or the URL was copied incompletely.

A versioned bucket cannot be deleted until every version and delete marker is gone. Empty it in the console with the Empty button, which removes all versions, then delete the bucket. If you created a KMS key, schedule its deletion (7 to 30 days) to stop the monthly charge.

aws s3 rm s3://$B --recursive
aws s3api delete-objects --bucket $B --delete "$(aws s3api list-object-versions --bucket $B --query '{Objects: Versions[].{Key:Key,VersionId:VersionId}}' --output json)"
aws s3api delete-objects --bucket $B --delete "$(aws s3api list-object-versions --bucket $B --query '{Objects: DeleteMarkers[].{Key:Key,VersionId:VersionId}}' --output json)"
aws s3api delete-bucket --bucket $B