title: AWS S3 Policy to show images (read-only). Please verify
body: <p>I am quite surprised how complicated it is to give read-only permissions to a AWS S3-bucket. Maybe it is just me but I would imagine several use S3 to store images for websites and thus, making them available, but read-only should be a "click and select"-option.</p>
  
  <p>Instead, as far as I understand, you use a bucket policy for this, using their <a href="http://awspolicygen.s3.amazonaws.com/policygen.html" rel="nofollow">bucket policy generator</a>.</p>
  
  <p>I have created this policy, which as far as I understand should do what I want:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "Policy1441664301333",
      "Statement": [
          {
              "Sid": "Stmt1441664293105",
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::my-bucket-name/*"
          }
      ]
  }
  </code></pre>
  
  <p>where <code>my-bucket-name</code> of course is replaced. This works in terms of making my images (the entire bucket is just images) publicly available. Since I don't understand the code in this policy at all and I can't seem to find out where to read about it I want to verify:</p>
  
  <ul>
  <li>Does this policy allow users to do anything else than to read the files in my bucket? I.e. could someone delete, upload files etc? Basically, am I in risk of something malicious to happen to my images?</li>
  </ul>
  
  <p>I believe this is borderline of what can be asked on StackOverflow but I assume this issue is quite common and as such would be interesting for others as well as reference.</p>