AWS S3 Public Object vs Private Object?

Question

Back in S3, I have URL's to images in my bucket that I will be presenting in my application, however they are set private. When I try to click on the link, it reads "access denied". When I change the setting of the link to public, It goes through, however I've read that public access isn't the safest thing. So this is essentially a two part question,

1) What is the difference between a public and private link/Object in a bucket?

2)And how can i make a private link/object in my bucket accessible to both myself and my users?

Answer 1

Private objects require authentication; public objects do not.

With regard to your comment "public access isn't the safest thing", you typically need to consider a couple of things when deciding whether or not to make an S3 object public:

1. [major] is it OK for anyone to download it? If the content of the object is something that you should not be sharing with the world, for example a user's family photos, then the answer is "no".
2. [minor] do you want to pay every time some unknown person downloads an object. As the bucket owner, you pay for data transfer out (unless you opt for 'requester pays' in which case the requester needs to authenticate).

There are at least two ways that you can make private S3 objects available to your users without them being accessible to the entire world:

1. use time-limited, pre-signed URLs for the objects (see this article)
2. proxy the object downloads yourself so that all requests for objects go to your app server and can therefore be restricted to authenticated sessions.