AWS Breaking (Change) News: New S3 Buckets Blocked For Public Access

README.md

See the Medium article for more details.

In a nutshell: AWS has recently rolled out a change wherein S3 buckets cannot be created with public access.

These Serverless snippets are for use in the article, with the final.form.yaml being the one that worked for us, but mileage may vary and some people (and parts of our own solution) needed different options.

attempt.1.yaml

resources:
  Description: My resources
  Resources:
    TheOffendingBucket:
      Type: AWS::S3::Bucket
      Properties:
        AccessControl: PublicRead
        BucketName: our-very-unique-bucket-name

attempt.2.yaml

resources:
  Description: My resources
  Resources:
    TheOffendingBucket:
      Type: AWS::S3::Bucket
      Properties:
        AccessControl: PublicRead
        BucketName: our-very-unique-bucket-name
        PublicAccessBlockConfiguration:
          BlockPublicAcls: false
          BlockPublicPolicy: false
          IgnorePublicAcls: false
          RestrictPublicBuckets: false

attempt.3.yaml

resources:
  Description: My resources
  Resources:
    TheOffendingBucket:
      Type: AWS::S3::Bucket
      Properties:
        AccessControl: PublicRead
        BucketName: our-very-unique-bucket-name
        OwnershipControls:
          Rules:
            - ObjectOwnership: BucketOwnerEnforced
        PublicAccessBlockConfiguration:
          BlockPublicAcls: false
          BlockPublicPolicy: false
          IgnorePublicAcls: false
          RestrictPublicBuckets: false

attempt.4.yaml

resources:
  Description: My resources
  Resources:
    TheOffendingBucket:
      Type: AWS::S3::Bucket
      Properties:
        AccessControl: PublicRead
        BucketName: our-very-unique-bucket-name
        OwnershipControls:
          Rules:
            # Note from the future: BucketOwnerPreferred might be better
            - ObjectOwnership: ObjectWriter
        PublicAccessBlockConfiguration:
          BlockPublicAcls: false
          BlockPublicPolicy: false
          IgnorePublicAcls: false
          RestrictPublicBuckets: false

final.form.yaml

resources:
  Description: My resources
  Resources:
    TheOffendingBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: our-very-unique-bucket-name
        OwnershipControls:
          Rules:
            # Note from the future: BucketOwnerPreferred might be better
            - ObjectOwnership: ObjectWriter
        PublicAccessBlockConfiguration:
          BlockPublicAcls: false
          BlockPublicPolicy: false
          IgnorePublicAcls: false
          RestrictPublicBuckets: false

original.yaml

resources:
  Description: My resources
  Resources:
    TheOffendingBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: our-very-unique-bucket-name