如何通过API获取AWS S3存储桶的Public公开访问标签信息？

Absolutely! You don’t need to rely on the S3 console to check if a bucket is marked as "Public"—AWS provides APIs that let you fetch this information directly. Here are the key methods you can use:

1. GetBucketPolicyStatus API (最直接的方式) #

This is the exact API AWS uses to determine whether to show the "Public" tag in the console. It returns a straightforward IsPublic boolean that matches what you see in the UI.

To use it via AWS CLI (which wraps the underlying REST API), run:

aws s3api get-bucket-policy-status --bucket your-bucket-name

A typical response will look like this:

{
  "PolicyStatus": {
    "IsPublic": true
  }
}

If the value is true, the bucket is marked as Public; false means it’s not.

2. GetBucketAcl API (用于验证ACL层面的公开访问) #

While this API fetches the bucket’s Access Control List (ACL) instead of a direct "Public" flag, you can parse its output to check if public groups (like AllUsers or AuthenticatedUsers) have been granted read/write permissions. This is useful if you want to dig into why a bucket is marked as Public.

Example CLI command:

aws s3api get-bucket-acl --bucket your-bucket-name

Look for entries where the Grantee.URI points to http://acs.amazonaws.com/groups/global/AllUsers with open permissions (e.g., READ or WRITE).

3. Batch checking with ListBuckets + GetBucketPolicyStatus #

If you need to check multiple buckets at once, start by using ListBuckets to get a full list of your buckets:

aws s3api list-buckets --query "Buckets[].Name"

Then loop through each bucket name and call GetBucketPolicyStatus for each one (you can script this with bash, Python, or your preferred language using the AWS SDK).

A quick note: AWS’s "Public" tag considers a combination of bucket policies, ACLs, and other access configurations. GetBucketPolicyStatus is the most reliable method because it aggregates all these factors to give you the same status the console displays.

内容的提问来源于stack exchange，提问作者saws