AWS: my S3 bucket returns 403 Access Denied when loading images on my site

Question

I uploaded images to S3 and use the object URL in `<img>` tags, but they return 403. I don't want to make the whole bucket public if that's unsafe.

Accepted Answer

New buckets block public access by default, which is a good default. Options, from best to simplest:

1. **CloudFront in front of a private bucket** (recommended): create a distribution with **Origin Access Control (OAC)**. The bucket policy allows only CloudFront. You get HTTPS, caching and a custom domain, and the bucket stays private.

2. **Presigned URLs**: for private, per-user files (invoices, documents), your backend generates short-lived URLs:

```js
import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const url = await getSignedUrl(new S3Client({}), new GetObjectCommand({ Bucket, Key }), { expiresIn: 300 });
```

3. **Public read on a dedicated prefix**: only for truly public assets, using a bucket policy on `arn:aws:s3:::bucket/public/*`. Never grant public write.

1 Answer