By default, all content in Amazon S3 is private.

There are then several ways that access can be granted to the content:

IAM Users

Access can be granted to specific IAM Users via an IAM Policy. This policy can be attached to a specific IAM User, or to an IAM Group of users. It can permit access to the bucket, and the bucket remains private.

Bucket Policy

A Bucket Policy can be added to a bucket that grants 'public' access to a bucket or a path within a bucket. Before adding a bucket policy, the "Block public access" settings that refer to bucket policies (the bottom two) must be turned Off.

For example, this Bucket Policy will make a bucket 'public', meaning that anyone who names the name of an object can download it:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Effect":"Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::EXAMPLE-BUCKET/*"
    }
  ]
}

For examples of bucket policies see: Bucket policy examples - Amazon Simple Storage Service

Object-level Access Control Lists (ACLs)

Individual object can also be made public by changing their ACL to 'public'. Before changing the ACL, the "Block public access" settings that refer to ACLs (the two two) must be turned Off.

Granting access via ACLs is less-common and is only useful when you want to grant public access to a limited number of objects in the bucket.