Production checklist
Amazon S3 production checklist: 6 checks before launch
6 checks for running Amazon S3 in production: 1 must-do, 4 should-dos and 1 good-to-have. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (1)
Turn on S3 Block Public Access
Misconfigured public buckets are one of the most common causes of data leaks.
Verify from the command line
All four settings should be true for the bucket (and for the account).
aws s3api get-public-access-block --bucket <bucket> aws s3control get-public-access-block --account-id <account-id>
Should do (4)
Serve private files with short-lived presigned URLs
Gives users access to one object for minutes instead of making the bucket public.
Verify with a request
A private object requested without a signature should get 403; the app hands out short-lived presigned URLs instead.
curl -sI https://<bucket>.s3.amazonaws.com/<private-key> | head -1
Deny requests that don’t use TLS in the bucket policy
A misconfigured client can otherwise read or write objects over plain HTTP.
Verify from the command line
The bucket policy should have a Deny statement for requests where aws:SecureTransport is false.
aws s3api get-bucket-policy --bucket <bucket> --query Policy --output text
Disable ACLs (Object Ownership: bucket owner enforced)
Access is then decided by policies alone, so one public-read ACL can’t expose an object.
Verify from the command line
ObjectOwnership should be BucketOwnerEnforced (the default for buckets created since April 2023).
aws s3api get-bucket-ownership-controls --bucket <bucket>
Give the app’s IAM role access to its own bucket only
A leaked key or SSRF bug then can’t read every bucket in the account.
Check the config
The app role’s policy allows only the actions it uses (for example s3:GetObject and s3:PutObject) on arn:aws:s3:::<bucket>/*, never s3:* on *. IAM Access Analyzer can flag broader grants.
Good to have (1)
Enable versioning on buckets holding user data
Recovers from accidental overwrites and deletes.
Verify from the command line
Status should be Enabled.
aws s3api get-bucket-versioning --bucket <bucket>
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.