AWS03 · AWS cloud engineering

S3 Lifecycle & Access Policy Puzzle

Lock a bucket so only one role can read reports, block public access and add lifecycle rules.

📶 L200⏱ 45 min🧪 Live lab

🎯 You will learn to

Write a bucket policy
Block public access
Add lifecycle transitions

🧪 Live environment

Runs entirely in your browser: nothing is installed, no real cloud account is used and your code is never sent to our server.

Loading the lab…

✅ Steps & checkpoints

Test anonymous read
Turn on Block Public Access
Allow the reports role
Add the lifecycle rule

🗺️ S3 access and lifecycle

Block Public Access and a bucket policy allow only one role to read; lifecycle rules move and expire old reports.

The 2D diagram shows the exact flow, ports and trust boundaries. The 3D scene is a concept view of the same parts; packets travel along the same arrows.

🤔 Think about it

Why is Block Public Access set at account level too?

Your answer (kept only on this device)

🛡️ Safety & cost

Mock mode by default. Real AWS practice is opt-in: use a sandbox account, AWS Budgets and least-privilege roles.

🧹 Cleanup

Delete the CloudFormation stack and check Cost Explorer the next day.

📚 Reference documents

Official sources, checked on 5 Nov 2026. Cloud services change often; check the official page before relying on a feature. All references