aws-cdk: S3 set publicReadAccess: true, fails deploy because of default deny public access policy

[irobinsonDandH]

Describe the bug

So, if you make a new s3 bucket

const staticBucket = new aws_s3.Bucket(s3Stack, `static-Bucket`, {
    bucketName: `static-bucket`,
    publicReadAccess: true,
    }
  })

While this is fine code and you can deploy it will fail in the middle with a generic access denied error not telling you what stopped it even if you are full admin. This happens due to the default deny all public access rule.

Expected Behavior

So if you make a new s3 bucket

const staticBucket = new aws_s3.Bucket(s3Stack, `static-Bucket`, {
    bucketName: `static-bucket`,
    publicReadAccess: true,
    }
  })

it will create the s3 bucket with the policy and set the deny public access to false for all 4 options

Current Behavior

Fails with access denied error while creating the bucket and doesn't say that it's because of the policy.

Reproduction Steps

Use the following code changing the bucket name to something unique.

const staticBucket = new aws_s3.Bucket(s3Stack, `static-Bucket`, {
    bucketName: `static-bucket`,
    publicReadAccess: true,
    }
  })

npx cdk deploy app

Possible Solution

A possible solution would be if you use publicReadAccess: true set all blockPublicAccess to false implicitly same if you use the grantPublicAccess() function.

or state in the documentation that you have to set blockPublicAceess to false and give a better error back.

blockPublicAccess: {
blockPublicAcls: false,
blockPublicPolicy: false,
ignorePublicAcls: false,
restrictPublicBuckets:false,
}

Additional Information/Context

No response

CDK CLI Version

2.124

Framework Version

No response

Node.js Version

18

OS

Debian

Language

TypeScript

Language Version

5.3.3

Other information

Current workaround is adding

blockPublicAccess: {
blockPublicAcls: false,
blockPublicPolicy: false,
ignorePublicAcls: false,
restrictPublicBuckets:false,
}

but I feel that publicReadAccess: true should just handle the bucket level permissions fully.

[pahud]

A possible solution would be if you use publicReadAccess: true set all blockPublicAccess to false implicitly same if you use the grantPublicAccess() function.
or state in the documentation that you have to set blockPublicAceess to false and give a better error back.

Yes we should do that with either of the suggested solutions.

At this moment the CFN is returning 403.

Resource handler returned message: "Access Denied (Service: S3, Status Code: 403, Request ID: NN0VTK51S1ER1XTQ, Extended Request ID: 9wQETvOzgpnTdjif2tnSvNuKsPF4wj2qzHgZdnT9fs5bHsNslLeN7kZI1yppemvKD2X+jpt
+zIE=)" (RequestToken: d4971ffd-f0d8-8229-750e-3193540cdafd, HandlerErrorCode: AccessDenied)

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[kennethaasan]

Same issue here. This is confusing and hard to understand how to fix unless you find this issue.