Public and private buckets

Private by default

New buckets are private and have Block Public Access turned on. Only you (in the console) and your access keys can read their files. To share a single file from a private bucket, use a presigned URL.

Make a bucket public

A public bucket lets anyone with the link download its files, which suits images, downloads and assets for a website. Uploading, deleting and listing still need an access key.

In the console: open the bucket’s settings and click Make public (or choose Public when you create the bucket). This also turns Block Public Access off.

With S3 tools: an Admin key turns Block Public Access off, then sets the bucket ACL to public-read:

EP=https://s3.dockhive.io
aws s3api delete-public-access-block --bucket my-app-assets --endpoint-url $EP
aws s3api put-bucket-acl --bucket my-app-assets --acl public-read --endpoint-url $EP

Files are then available at:

https://s3.dockhive.io/<bucket>/<key>
https://s3.dockhive.io/my-app-assets/images/logo.png

Downloads through public links count toward your download allowance (egress), billed to you as the bucket owner.

Make one object public

When Block Public Access is off, an Admin key can upload a single object as public in an otherwise private bucket with the public-read canned ACL:

aws s3 cp logo.png s3://my-app-uploads/public/logo.png --acl public-read --endpoint-url $EP

Make a bucket private again

Click Make private in the bucket’s settings, or set the ACL back:

aws s3api put-bucket-acl --bucket my-app-assets --acl private --endpoint-url $EP

Block Public Access

Block Public Access is a safety switch that overrides everything else: while it’s on, nothing in the bucket can be read anonymously, whatever the ACLs or bucket policy say.

• Turning it on makes public ACLs and public policy statements stop working straight away.
• While it’s on, a bucket policy that grants access to everyone ("Principal": "*" not limited to certain IP addresses) is refused.
• Manage it in the bucket’s settings, or with put-public-access-block, get-public-access-block and delete-public-access-block (Admin keys).

aws s3api put-public-access-block --bucket my-app-uploads --endpoint-url $EP \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

get-bucket-policy-status tells you whether a bucket is public through its ACL or its policy.

ACLs

Hive Buckets supports the canned ACLs private and public-read, on buckets and objects. x-amz-grant-* headers are accepted only when they amount to one of those two. Other canned ACLs and grants to other accounts aren’t supported; use a bucket policy to give other access keys access.

HTML and SVG files

For your security, HTML and SVG files are served as downloads (Content-Disposition: attachment) from public links and presigned URLs, so a browser saves them instead of displaying them. This stops a bucket from being used to run scripts on a DockHive address.

Static website hosting from a bucket isn’t available yet (PutBucketWebsite returns NotImplemented); it’s coming later. To host a site today, deploy it as an app and keep large media in a bucket.