GetPublicAccessBlock

GetPublicAccessBlock returns a bucket's Block Public Access configuration - on Amazon S3, a set of switches that stop ACLs and policies from making a bucket public. STRG keeps this simpler: a bucket is public or private through one setting, so there is no separate configuration to return. The operation checks that the bucket exists and answers 404 NoSuchPublicAccessBlockConfiguration - the same answer Amazon S3 gives for a bucket that has never had one. Tools that read it while describing a bucket, such as the AWS CLI, already treat NoSuchPublicAccessBlockConfiguration as "not configured", so they work unchanged.

Whether a bucket is public or private is its Bucket Protection setting in the dashboard. Over the S3 API, GetBucketAcl reports it: private for a Protected bucket, public-read for one without protection.

Good to know on STRG

Buckets have no Block Public Access configuration, so the answer is always 404 NoSuchPublicAccessBlockConfiguration, never a configuration.
PutPublicAccessBlock and DeletePublicAccessBlock are answered with 501 NotImplemented, so a client knows straight away.
x-amz-expected-bucket-owner is welcome and has nothing to check: a key only ever reaches buckets of its own account.

When you'd use it

Tools that describe a bucket. The AWS CLI, infrastructure-as-code tools and inventory scripts written for Amazon S3 read the Block Public Access configuration along with a bucket's other settings. On STRG they get the familiar "not configured" answer and carry on.
Security and compliance checks. An audit script that looks for buckets without Block Public Access finds every bucket reporting "not configured". The question it is really asking - is this bucket readable by anyone? - is answered by GetBucketAcl, and Anonymous reads describes what a public bucket allows.

Request

GET /?publicAccessBlock HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

The path-style form is GET /my-bucket?publicAccessBlock on s3.eu-central-1.strg.com - Addressing explains both.

Permissions

The access key needs Read bucket settings (buckets:read-config). Every access key holds it, whether it covers all buckets or only some - a key scoped to specific buckets reads only those. Access keys has the details.

URI parameters

Name	Type	Required	Description
`Bucket`	String	Yes	The bucket whose configuration to read.
`publicAccessBlock`	Flag	Yes	Selects this operation. Sent with no value.

Any other query parameter is answered with 501 NotImplemented, so a client knows straight away that it has no effect here.

Request headers

Name	Type	Required	Description
`x-amz-expected-bucket-owner`	String	No	Welcome, with nothing to check: an access key only ever reaches its own account's buckets.

Request body

None.

Response

For a bucket that exists, the answer is always the 404 NoSuchPublicAccessBlockConfiguration error below. A 200 OK with a configuration is never sent.

Response headers

Name	Description
`Content-Type`	`application/xml` - the error document.
`x-amz-request-id`	The request ID, handy for a support request.

Response body

These are the elements Amazon S3 sends in a successful answer; on STRG none of them appears.

Element	Type	Description
`PublicAccessBlockConfiguration`	Container	Never sent. On Amazon S3, the root of a successful answer, holding the four settings below.
`BlockPublicAcls`	Boolean	Never sent. On Amazon S3, whether public ACLs are refused on the bucket and its objects.
`IgnorePublicAcls`	Boolean	Never sent. On Amazon S3, whether public ACLs on the bucket and its objects are ignored.
`BlockPublicPolicy`	Boolean	Never sent. On Amazon S3, whether a public bucket policy is refused.
`RestrictPublicBuckets`	Boolean	Never sent. On Amazon S3, whether access through a public bucket policy is restricted to the owning account.

This is what STRG sends instead, for a path-style request - Resource is the request path:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
  <Code>NoSuchPublicAccessBlockConfiguration</Code>
  <Message>The public access block configuration was not found</Message>
  <Resource>/my-bucket</Resource>
  <BucketName>my-bucket</BucketName>
  <RequestId>...</RequestId>
</Error>

Errors

These are the errors this request can return, and the situation behind each one.

Code	HTTP status	When
`NoSuchPublicAccessBlockConfiguration`	404	Always, for a bucket that exists and that the access key can reach.
`NoSuchBucket`	404	The bucket does not exist, belongs to another account, is in a region other than the endpoint's, or the account stores nothing in the endpoint's region yet.
`AccessDenied`	403	The access key is scoped to buckets that do not include this one, the account is not active, or the request is unsigned.
`InvalidAccessKeyId`	403	The access key does not exist, has expired or been revoked - or it was created moments ago and is not usable yet in a region where the account already stores data, in which case the same request works shortly afterwards.
`SignatureDoesNotMatch`	403	The request signature does not match.
`RequestTimeTooSkewed`	403	The request time is more than 15 minutes from the server's.
`AuthorizationHeaderMalformed`	400	The signature's credential scope names a region other than the endpoint's.
`NotImplemented`	501	The request carries a query parameter this operation does not accept.
`SlowDown`	503	Too many requests. The `Retry-After` header says when a retry is welcome; the AWS SDKs retry on their own.
`ServiceUnavailable`	503	A temporary failure; the same request can be retried.
`InternalError`	500	An unexpected failure while checking the bucket; the same request can be retried.

Differences from Amazon S3

The table lists each place where STRG behaves differently, and what that means for a client.

Aspect	Amazon S3	STRG
Block Public Access	Four settings per bucket, combined with the account's	Buckets have no such configuration. The answer is always `404 NoSuchPublicAccessBlockConfiguration`
Making a bucket public or private	ACLs and bucket policies, gated by Block Public Access	One setting, Bucket Protection in the dashboard; GetBucketAcl reads it
Setting or removing the configuration	PutPublicAccessBlock, DeletePublicAccessBlock	Answered with `501 NotImplemented`
Bucket in another region	`301` redirect with `x-amz-bucket-region`	`404 NoSuchBucket`. A bucket is reached through its own regional endpoint.
`x-amz-expected-bucket-owner`	Checked against the bucket owner	Welcome, with nothing to check

Examples

Every client reports NoSuchPublicAccessBlockConfiguration as an error, and each example below treats it as "no Block Public Access configuration".

AWS CLI
Python (boto3)
JavaScript (AWS SDK v3)

aws s3api get-public-access-block \
  --bucket my-bucket \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1

The command ends with An error occurred (NoSuchPublicAccessBlockConfiguration) when calling the GetPublicAccessBlock operation: The public access block configuration was not found and a non-zero exit status.

import boto3
from botocore.exceptions import ClientError

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

try:
    response = s3.get_public_access_block(Bucket="my-bucket")
    print(response["PublicAccessBlockConfiguration"])
except ClientError as error:
    if error.response["Error"]["Code"] == "NoSuchPublicAccessBlockConfiguration":
        print("no public access block configuration")
    else:
        raise

import { GetPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

try {
  const response = await client.send(new GetPublicAccessBlockCommand({ Bucket: "my-bucket" }));
  console.log(response.PublicAccessBlockConfiguration);
} catch (error) {
  if (error.name === "NoSuchPublicAccessBlockConfiguration") {
    console.log("no public access block configuration");
  } else {
    throw error;
  }
}

GetBucketAcl - whether the bucket is public
PutBucketAcl
GetBucketPolicy
Access keys
S3 API overview - including the other S3 operations

View as Markdown

When you'd use it​

Request​

Permissions​

URI parameters​

Request headers​

Request body​

Response​

Response headers​

Response body​

Errors​

Differences from Amazon S3​

Examples​

Related​