title: How to set public read only access on Amazon S3 Bucket?
body: <p>I have found a couple of similar questions on StackOverflow like <a href="https://stackoverflow.com/questions/2547046/make-a-bucket-public-in-amazon-s3">this one</a> but they are quite old and it seems things have changed with S3 since then. They added these four settings which are quite confusing:
  <a href="https://i.stack.imgur.com/NgdeU.png" rel="noreferrer"><img src="https://i.stack.imgur.com/NgdeU.png" alt="enter image description here"></a>
  <strong>If I turn these off, does it mean it makes my bucket writable by public?</strong> 
  In addition I also added this policy:</p>
  
  <pre><code>{
  "Version": "2008-10-17",
  "Statement": [
      {
          "Sid": "PublicReadForGetBucketObjects",
          "Effect": "Allow",
          "Principal": {
              "AWS": "*"
          },
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::REDACTED/*"
      },
      {
          "Effect": "Allow",
          "Principal": {
              "AWS": "arn:aws:iam::REDACTED:user/REDACTED"
          },
          "Action": "s3:*",
          "Resource": [
              "arn:aws:s3:::REDACTED",
              "arn:aws:s3:::REDACTED/*"
          ]
      }
  ]
  </code></pre>
  
  <p>and this CORS configuration:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;REDACTED&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;PUT&lt;/AllowedMethod&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <p>I am trying to give public read access and restrict full access to a user I created in IAM.
  <strong>I would appreciate if someone could confirm that my settings are correct or in case they are not point me to the resources I need to get it right.</strong> </p>