Cloud security basics · Lesson 4 of 5
Keep cloud files private on purpose
Uploading a file and deciding who can read it are separate tasks. Cloud storage needs deliberate access rules, especially when private records and public website assets live nearby.
Two kinds of files. Two intended audiences.
Fictional training service
- Public thumbnailsVisitors
Read access is intentional for public website assets.
- Private learner exportsAuthorized application
Keep public access blocked and grant only required application access.
Read the visualThe app cannot read an export. Should you make the export storage public?
No. Check the app’s effective permissions while preserving the intended private audience.
Classify before sharing
Decide whether the content is public, internal, or restricted before choosing its audience. A hard-to-guess file name is not an access control.
Use available guardrails
For example, Amazon S3 Block Public Access can prevent public permissions at supported levels. A private bucket should not need a public-read policy just to serve an authorized application.
Verify the effective access
Review the policies and guardrails together. Test the intended access safely, including that an unauthorized identity is denied.
Put it in context
A fictional team stores public course thumbnails and private learner exports. Instead of making the export bucket public to fix a download error, the team checks the application’s permissions. Only the intended service receives the access it needs.
Fix access for the intended audience without widening it to everyone.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.