Block public access to OSS buckets, access points, and accounts-Object Storage Service(OSS)-阿里云帮助中心

Block Public Access prevents anonymous access to OSS resources at the account, bucket, access point, or Object FC Access Point level. When enabled, existing public permissions are ignored and new ones cannot be created.

Check for public access in bucket policies and ACLs

Review bucket policies and ACLs to check whether objects are publicly accessible. If any grant public access, enable Block Public Access.

Bucket policy

(Recommended) Call the GetBucketPolicyStatus operation

Call GetBucketPolicyStatus to check whether a bucket policy grants public access.

If IsPublic is true, the bucket policy grants public access.
If IsPublic is false, the bucket policy does not grant public access.

For more information, see GetBucketPolicyStatus.

Manually review bucket policy settings

Conditions and examples for non-public access

A bucket policy statement is non-public if its Principal or Condition element meets any of these criteria.

Note

The Action and Resource elements do not affect public access evaluation.
If the Effect element is Deny, the policy does not grant public access.

Element	Field	Value
Principal	N/A	Specifies one or more fixed values without the asterisk (*) wildcard.
Condition	acs:SourceVpcId	Specifies one or more fixed values without the asterisk (*) wildcard.
	acs:SourceVpc	Specifies one or more fixed values without the asterisk (*) wildcard.
	acs:AccessId	Specifies one or more fixed values without the asterisk (*) wildcard.
	acs:SourceVpcIp	For IPv4 addresses, the mask must be greater than or equal to 8. For IPv6 addresses, the mask must be greater than or equal to 32.
	acs:SourceIp	For IPv4 addresses, the mask must be greater than or equal to 8. For IPv6 addresses, the mask must be greater than or equal to 32.

The following example bucket policy grants non-public access:

{
    "Version":"1",
    "Statement":[
        {
            "Action":[
                "oss:GetObject",
                "oss:GetObjectAcl",
                "oss:GetObjectVersion",
                "oss:GetObjectVersionAcl"
            ],
            "Effect":"Allow",
            "Principal":[
                "20214760404935xxxx"
            ],
            "Resource":[
                "acs:oss:*:174649585760xxxx:examplebucket/hangzhou/2020/*",
                "acs:oss:*:174649585760xxxx:examplebucket/shanghai/2015/*"
            ]
        },
        {
            "Action":[
                "oss:ListObjects",
                "oss:ListObjectVersions"
            ],
            "Condition":{
                "StringLike":{
                    "oss:Prefix":[
                        "hangzhou/2020/*",
                        "shanghai/2015/*"
                    ]
                }
            },
            "Effect":"Allow",
            "Principal":[
                "20214760404935xxxx"
            ],
            "Resource":[
                "acs:oss:*:174649585760xxxx:examplebucket"
            ]
        }
    ]
}

Conditions and examples for public access

A bucket policy grants public access if it does not meet the non-public access criteria. Examples:

Example 1

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss:GetObject",
            "Principal": "*",
            "Resource": "acs:oss:*:17464958576xxxx:examplebucket/*"
        }
    ]
}

Example 2

If a bucket policy contains both a statement allowing access from all VPCs and a non-public statement for specific users, the policy grants public access.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss:GetObject",
            "Principal": "*",
            "Resource": "acs:oss:*:17464958576xxxx:examplebucket/*",
            "Condition": {
                "StringLike": {
                    "acs:SourceVpc": [
                        "vpc-*"
                        ]
                }
            }
        },
      	{
            "Effect": "Allow",
            "Action": "oss:*",
            "Principal": "27464958576xxxx",
            "Resource": "*"
        }
    ]
}

ACL

If the bucket ACL or object ACL is public-read or public-read-write, public access is allowed.
If both the bucket ACL and object ACL are private, public access is denied.

Block Public Access priority

Block Public Access applies at account, bucket, access point, and Object FC Access Point levels. When set at multiple levels, OSS follows this priority:

Account > Bucket > Access point > Object FC Access Point

Higher-level settings override lower-level ones. For example, account-level Block Public Access blocks public access for all buckets, access points, and Object FC Access Points, regardless of their individual settings.

To allow public access to a bucket, disable Block Public Access at the global and bucket levels.
To allow public access through an access point, disable Block Public Access at the account, bucket, and access point levels.
To allow public access through an Object FC Access Point, disable Block Public Access at the account, bucket, access point, and Object FC Access Point levels.

Usage notes

A RAM user must have the following permissions to manage Block Public Access:
- At the account level: oss:PutPublicAccessBlock, oss:GetPublicAccessBlock, and oss:DeletePublicAccessBlock
- For individual buckets: oss:PutBucketPublicAccessBlock, oss:GetBucketPublicAccessBlock, and oss:DeleteBucketPublicAccessBlock
- For individual access points: oss:PutAccessPointPublicAccessBlock, oss:GetAccessPointPublicAccessBlock, and oss:DeleteAccessPointPublicAccessBlock
- For individual Object FC Access Points: oss:PutAccessPointConfigForObjectProcess, oss:GetAccessPointConfigForObjectProcess, and oss:DeleteAccessPointForObjectProcess
When enabled, existing public access permissions are ignored and new ones cannot be configured. When disabled, existing permissions resume and new ones can be configured.
If a bucket policy allows all users to manage an access point, users can change its Block Public Access status through the bucket subdomain, even when Block Public Access is enabled for the access point. Access point settings do not apply to requests through bucket subdomains.
During cross-region replication (CRR) and same-region replication (SRR), object ACLs are preserved regardless of Block Public Access settings. If Block Public Access is enabled on the destination bucket, replicated objects cannot be publicly accessed even if their ACL is public-read or public-read-write.

Methods

Use the OSS console

Enable Block Public Access at the global level

Log on to the OSS console.
In the left-side navigation pane, choose Data Service > Block Public Access.
On the Block Public Access page, turn on Block Public Access and complete the on-screen instructions.

By default, OSS-wide Block Public Access is disabled (BlockPublicAccess=false), which means public access is allowed until you turn it on. You can call the GetPublicAccessBlock operation to check the current state, and call PutPublicAccessBlock or use the console switch described in the preceding steps to enable it.

If you use the Cloud Governance Center EnrollAccount operation to create a ResourceAccount-type member account, that account cannot log on to the OSS console directly to complete the preceding steps. The sign-in and role-switching entries for the account are disabled, and calling AssumeRole for the AliyunRDAdminAccessRole role also fails with the EntityNotExist.Role error. To enable OSS-wide Block Public Access for this kind of member account, create a RAM role for the member account first, obtain temporary credentials by calling AssumeRole with that role, and then use the credentials to call the PutPublicAccessBlock operation.

The Cloud Governance Center account baseline does not include OSS Block Public Access as a configuration item, so it is not enabled automatically when a member account is enrolled. You must enable Block Public Access separately for each member account, either through the console or by calling PutPublicAccessBlock. For member accounts that cannot log on to the console directly, use the RAM role and AssumeRole method described above.

Enable Block Public Access for a bucket

Log on to the OSS console.
In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.
In the left-side navigation tree, choose Permission Control > Block Public Access.
On the Block Public Access tab, turn on Block Public Access and complete the on-screen instructions.

Enable Block Public Access for an access point

Log on to the OSS console.
In the left-side navigation pane, click Access Points. Click the target access point.
In the Basic Information section, click Enable next to Block Public Access and complete the on-screen instructions.

Enable Block Public Access for an Object FC Access Point

Log on to the OSS console.
In the left-side navigation pane, click Object FC Access Points. Click the target Object FC Access Point.
In the Basic Information section, click Enable next to Block Public Access and complete the on-screen instructions.

Use ossutil

Use ossutil to enable Block Public Access. To install ossutil, see Install ossutil.

Enable Block Public Access at the account level:

ossutil api put-public-access-block --public-access-block-configuration "{\"BlockPublicAccess\":\"true\"}"

For more information, see put-public-access-block.

Enable Block Public Access for examplebucket:

ossutil api put-bucket-public-access-block --bucket examplebucket --public-access-block-configuration "{\"BlockPublicAccess\":\"true\"}"

For more information, see put-bucket-public-access-block.

Enable Block Public Access for access point ap-01:

ossutil api put-access-point-public-access-block --bucket examplebucket --access-point-name ap-01 --public-access-block-configuration "{\"BlockPublicAccess\":\"true\"}"

For more information, see put-access-point-public-access-block.

Related API operations

Call RESTful APIs directly with signature calculation in your code.

Refer to PutPublicAccessBlock to block public access at the account level.
Refer to PutBucketPublicAccessBlock to block public access for a bucket.
Refer to PutAccessPointPublicAccessBlock to block public access for an access point.
Refer to PutAccessPointConfigForObjectProcess to block public access for an Object FC Access Point.

Impact and migration guide

If you change a bucket ACL from public-read to private and then enable Block Public Access, anonymous URL requests to objects in the bucket return 403 Forbidden. Any business that relies on anonymous access is interrupted. A typical error response looks like this:

AccessDenied
You have no right to access this object because of bucket acl.

To restore access without exposing the bucket to public reads, use one of the following methods instead of anonymous access:

Signed URL: Grants temporary access for a specified period of time. Use this method for short-lived or one-off access scenarios.
Bucket policy: Grants long-term access to specific accounts, IP addresses, or referrers. Use this method when you need to authorize a known, fixed set of callers on an ongoing basis.

Before you apply this change to a production bucket, verify the new access method in a test bucket, and make the change during off-peak hours to confirm that your business is not affected before you roll it out.

FAQ

What does it mean if I cannot create a bucket policy because Block Public Access is enabled?

If Block Public Access is enabled for a bucket, a bucket policy that grants public access (for example, one that sets Principal to *) is rejected. The request fails with an HTTP 403 error and the error message Put public bucket policy is not allowed. To create a bucket policy that grants public access, disable Block Public Access for the bucket first. After Block Public Access is disabled, you can create the bucket policy.

How do I disable Block Public Access?

The following procedure uses the bucket level as an example:

Log on to the OSS console.
In the left-side navigation pane, click Buckets. On the page that appears, click the name of the target bucket.
In the left-side navigation tree, choose Permission Control > Block Public Access.
On the Block Public Access tab, turn off Block Public Access.
In the confirmation dialog box that appears, enter the confirmation phrase shown in the dialog box, and then click OK.

After you disable Block Public Access, existing public access permissions take effect again. For a bucket whose ACL is public-read, anonymous users can access objects in the bucket again.

Are there security risks after I disable Block Public Access?

After you disable Block Public Access, any bucket ACL and bucket policy permissions that were previously ignored take effect immediately. Before you disable Block Public Access, confirm the following:

The bucket ACL is set to private.
The object ACL is set to private.
The bucket policy does not grant any unintended public access.

Monitoring and alerting

Changes to the Block Public Access status are management operations and are not recorded in real-time access logs. Use ActionTrail event tracking or API polling to monitor status changes and configure alerts.

ActionTrail event tracking (recommended)

In the ActionTrail console, create a trail. Set the event type to management events, and deliver the events to Simple Log Service (SLS).
On the event alerting page, create an alert rule and set the event names to PutBucketPublicAccessBlock and DeleteBucketPublicAccessBlock.
An alert notification is triggered when the Block Public Access status is modified.

API polling

Call the GetPublicAccessBlock operation to obtain the account-level Block Public Access configuration status. Report the result as a custom metric to Cloud Monitor, and configure a threshold-based alert rule.