# Ensure Amazon LightSail Bucket is not publicly accessible

- Source: https://support.icompaas.com/support/solutions/articles/62000220071-ensure-amazon-lightsail-bucket-is-not-publicly-accessible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [Amazon Lightsail](https://support.icompaas.com/support/solutions/folders/62000167575)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Description:

Lightsail provides object storage called a bucket that is used to store your data. You can add objects to your bucket by uploading files using the Lighsail console or by configuring your application to put content like logs or other application data in the bucket.

  

### Rational:

If the bucket or object is public, anyone in the world can read its content.

  

### Impact:

When the bucket is private only users with appropriate permissions have access to the bucket and objects.

  

### Default value:

Lightsail buckets and objects are set to private by default.

  

**Audit:**

1.  Sign in to AWS Management console
    
2.  Go to the Lightsail service at [https://lightsail.aws.amazon.com/](https://lightsail.aws.amazon.com/ "https://lightsail.aws.amazon.com/")
    
3.  Select the storage tab and choose the bucket and click on it to examine
    
4.  Go to the permissions tab and check it’s access permissions  
    ![](https://support.icompaas.com/assets/kb/de749ddd963a8f2b.png)
    
    If you notice the access is public, follow the I implementation steps.
    

  

**Remediation:**

**Pre-requisites:**

-   Sign in as admin or IAM user with required permissions
    

**Implementation Steps:**

1.  Sign into AWS Management console
    
2.  Go to the Lightsail service at [https://lightsail.aws.amazon.com/](https://lightsail.aws.amazon.com/ "https://lightsail.aws.amazon.com/")
    
3.  Select the storage tab and choose the bucket and click on it to modify
    
4.  Go to the permissions tab and click on Change permissions  
    ![](https://support.icompaas.com/assets/kb/d6359fe9b52f391a.png)
    
5.  Select All objects are private so, objects are readable only by you or anyone you give access to  
    ![](https://support.icompaas.com/assets/kb/9623adc80757adb7.png)
    
6.  Click on save 
    

  

Via CLI:

 update-bucket
--bucket-name <value>
\[--access-rules <value>\]
\[--readonly-access-accounts <value>\]

  

**Backout plan:**

To revoke the changes made follow the implementation steps and choose the option required at step 5 and click on save.

**Reference:**

**[](https://aws.amazon.com/lightsail/ "https://aws.amazon.com/lightsail/")**[](https://aws.amazon.com/lightsail/ "https://aws.amazon.com/lightsail/")[https://aws.amazon.com/lightsail/](https://aws.amazon.com/lightsail/ "https://aws.amazon.com/lightsail/")

[![](https://support.icompaas.com/assets/kb/8352f160614e0d24.png)update-bucket — AWS CLI 1.20.54 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/lightsail/update-bucket.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.