Disable access to all content in bucket at root path

[thrijith]

• Is it expected for all content to be displayed when going to the root of the bucket URL?
• If someone goes to the root of the bucket URL, it shows all media in XML format.

<ListBucketResult xmlns="http://doc.s3.amazonaws.com/2006-03-01">
    <Name>bucket-name</Name>
    <Prefix/>
    <Marker/>
    <NextMarker>11/5-160x160.jpg</NextMarker>
    <IsTruncated>true</IsTruncated>
    <Contents>
        <Key>1/.DS_Store</Key>
        <Generation>150112259202467570888</Generation>
        <MetaGeneration>3</MetaGeneration>
        <LastModified>2017-10-18T18:47:47.542Z</LastModified>
        <ETag>"bdc5a4dc6btv5gv89eo51p58b5f30181ca032b56265"</ETag>
        <Size>6148</Size>
    </Contents>
</ListBucketResult>

[amjo]

Unsure if this is for Amazon or GCS, but for those who have having issues on GCS with this same inquiry, then Yes, you can disable the bucket listing feature for public access. The common way to do this while still allowing public access to individual objects is to change the IAM role granted to allUsers if that's what you have done.

Instead of granting Storage Object Viewer to allUsers, you should grant Storage Legacy Object Reader. The Storage Legacy Object Reader role allows unauthenticated users to read objects if they know the object's URL but does not permit listing the contents of the bucket.

Steps to modify permissions:

• Go to the Google Cloud Console.
• Navigate to Cloud Storage > Buckets.
• Select your bucket.
• Go to the "Permissions" tab.
• Find the entry for allUsers (or the SA you've given the permissions)
• Remove the Storage Object Viewer role.
• Add a new permission for allUsers (or your SA) and select the role Storage Legacy Object Reader.