Hands-on emulator lab · 6–10 min
Keep a bucket private while sharing a website — S3 and Block Public Access and CloudFront
Save and inspect all four public-access safeguards on a bucket.
These actions use an isolated AWS Emulator. It stores API state locally; it does not create paid cloud resources or run the full hosted AWS service.
Your goal
Save and inspect all four public-access safeguards on a bucket.
Why this matters
A mistaken public permission can share more data than intended. Block Public Access adds safeguards against those choices. You will save all four settings and read them back.
Words you will use
Block Public Access helps prevent public S3 permissions. An origin is where a delivery service gets content. Origin access control lets CloudFront sign requests to a suitable S3 origin.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Create your practice bucket
Start by creating a bucket in your private emulator. Its unique name appears in the response. This bucket is the resource you will configure in the next step.
2. Block public permissions
Enable all four Block Public Access settings. These settings restrict public permission choices. We will read their stored values; this is not a full security test of the real AWS service.
3. Read the setting back
Ask S3 for the current setting. Compare the returned value with what you submitted. Completion uses this fresh response, so a button click by itself is not enough.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.