# GetPublicAccessBlock

GetPublicAccessBlock returns a bucket's Block Public Access configuration - on Amazon S3, a set
of switches that stop ACLs and policies from making a bucket public. STRG keeps this
simpler: a bucket is public or private through one setting, so there is no separate
configuration to return. The operation checks that the bucket exists and answers
`404 NoSuchPublicAccessBlockConfiguration` - the same answer Amazon S3 gives for a bucket that
has never had one. Tools that read it while describing a bucket, such as the AWS CLI, already
treat `NoSuchPublicAccessBlockConfiguration` as "not configured", so they work unchanged.

Whether a bucket is public or private is its *Bucket Protection* setting in the dashboard. Over
the S3 API, [GetBucketAcl](https://docs.strg.com/s3-api/GetBucketAcl) reports it: `private` for a *Protected* bucket,
`public-read` for one without protection.

**Info: Good to know on STRG**

- Buckets have no Block Public Access configuration, so the answer is always
  `404 NoSuchPublicAccessBlockConfiguration`, never a configuration.
- PutPublicAccessBlock and DeletePublicAccessBlock are answered with `501 NotImplemented`, so a
  client knows straight away.
- `x-amz-expected-bucket-owner` is welcome and has nothing to check: a key only ever reaches
  buckets of its own account.

## When you'd use it

- **Tools that describe a bucket.** The AWS CLI, infrastructure-as-code tools and inventory
  scripts written for Amazon S3 read the Block Public Access configuration along with a bucket's
  other settings. On STRG they get the familiar "not configured" answer and carry on.
- **Security and compliance checks.** An audit script that looks for buckets without Block
  Public Access finds every bucket reporting "not configured". The question it is really asking -
  is this bucket readable by anyone? - is answered by [GetBucketAcl](https://docs.strg.com/s3-api/GetBucketAcl), and
  [Anonymous reads](https://docs.strg.com/s3-api/overview#anonymous-reads) describes what a public bucket allows.

## Request

```http
GET /?publicAccessBlock HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
```

The path-style form is `GET /my-bucket?publicAccessBlock` on `s3.eu-central-1.strg.com` -
[Addressing](https://docs.strg.com/s3-api/overview#addressing) explains both.

### Permissions

The access key needs **Read bucket settings** (`buckets:read-config`). Every access key holds
it, whether it covers all buckets or only some - a key scoped to specific buckets reads only
those. [Access keys](https://docs.strg.com/access-keys) has the details.

### URI parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Bucket` | String | Yes | The bucket whose configuration to read. |
| `publicAccessBlock` | Flag | Yes | Selects this operation. Sent with no value. |

Any other query parameter is answered with `501 NotImplemented`, so a client knows straight away
that it has no effect here.

### Request headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `x-amz-expected-bucket-owner` | String | No | Welcome, with nothing to check: an access key only ever reaches its own account's buckets. |

### Request body

None.

## Response

For a bucket that exists, the answer is always the `404 NoSuchPublicAccessBlockConfiguration`
error below. A `200 OK` with a configuration is never sent.

### Response headers

| Name | Description |
| --- | --- |
| `Content-Type` | `application/xml` - the error document. |
| `x-amz-request-id` | The request ID, handy for a support request. |

### Response body

These are the elements Amazon S3 sends in a successful answer; on STRG none of them appears.

| Element | Type | Description |
| --- | --- | --- |
| `PublicAccessBlockConfiguration` | Container | Never sent. On Amazon S3, the root of a successful answer, holding the four settings below. |
| `BlockPublicAcls` | Boolean | Never sent. On Amazon S3, whether public ACLs are refused on the bucket and its objects. |
| `IgnorePublicAcls` | Boolean | Never sent. On Amazon S3, whether public ACLs on the bucket and its objects are ignored. |
| `BlockPublicPolicy` | Boolean | Never sent. On Amazon S3, whether a public bucket policy is refused. |
| `RestrictPublicBuckets` | Boolean | Never sent. On Amazon S3, whether access through a public bucket policy is restricted to the owning account. |

This is what STRG sends instead, for a path-style request - `Resource` is the request path:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<Error>
  <Code>NoSuchPublicAccessBlockConfiguration</Code>
  <Message>The public access block configuration was not found</Message>
  <Resource>/my-bucket</Resource>
  <BucketName>my-bucket</BucketName>
  <RequestId>...</RequestId>
</Error>
```

## Errors

These are the errors this request can return, and the situation behind each one.

| Code | HTTP status | When |
| --- | --- | --- |
| `NoSuchPublicAccessBlockConfiguration` | 404 | Always, for a bucket that exists and that the access key can reach. |
| `NoSuchBucket` | 404 | The bucket does not exist, belongs to another account, is in a region other than the endpoint's, or the account stores nothing in the endpoint's region yet. |
| `AccessDenied` | 403 | The access key is scoped to buckets that do not include this one, the account is not active, or the request is unsigned. |
| `InvalidAccessKeyId` | 403 | The access key does not exist, has expired or been revoked - or it was created moments ago and is not usable yet in a region where the account already stores data, in which case the same request works shortly afterwards. |
| `SignatureDoesNotMatch` | 403 | The request signature does not match. |
| `RequestTimeTooSkewed` | 403 | The request time is more than 15 minutes from the server's. |
| `AuthorizationHeaderMalformed` | 400 | The signature's credential scope names a region other than the endpoint's. |
| `NotImplemented` | 501 | The request carries a query parameter this operation does not accept. |
| `SlowDown` | 503 | Too many requests. The `Retry-After` header says when a retry is welcome; the AWS SDKs retry on their own. |
| `ServiceUnavailable` | 503 | A temporary failure; the same request can be retried. |
| `InternalError` | 500 | An unexpected failure while checking the bucket; the same request can be retried. |

## Differences from Amazon S3

The table lists each place where STRG behaves differently, and what that means for a client.

| Aspect | Amazon S3 | STRG |
| --- | --- | --- |
| Block Public Access | Four settings per bucket, combined with the account's | Buckets have no such configuration. The answer is always `404 NoSuchPublicAccessBlockConfiguration` |
| Making a bucket public or private | ACLs and bucket policies, gated by Block Public Access | One setting, *Bucket Protection* in the dashboard; [GetBucketAcl](https://docs.strg.com/s3-api/GetBucketAcl) reads it |
| Setting or removing the configuration | PutPublicAccessBlock, DeletePublicAccessBlock | Answered with `501 NotImplemented` |
| Bucket in another region | `301` redirect with `x-amz-bucket-region` | `404 NoSuchBucket`. A bucket is reached through its own regional endpoint. |
| `x-amz-expected-bucket-owner` | Checked against the bucket owner | Welcome, with nothing to check |

## Examples

Every client reports `NoSuchPublicAccessBlockConfiguration` as an error, and each example below
treats it as "no Block Public Access configuration".

**AWS CLI**

```bash
aws s3api get-public-access-block \
  --bucket my-bucket \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1
```

The command ends with `An error occurred (NoSuchPublicAccessBlockConfiguration) when calling the
GetPublicAccessBlock operation: The public access block configuration was not found` and a
non-zero exit status.

**Python (boto3)**

```python
import boto3
from botocore.exceptions import ClientError

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

try:
    response = s3.get_public_access_block(Bucket="my-bucket")
    print(response["PublicAccessBlockConfiguration"])
except ClientError as error:
    if error.response["Error"]["Code"] == "NoSuchPublicAccessBlockConfiguration":
        print("no public access block configuration")
    else:
        raise
```

**JavaScript (AWS SDK v3)**

```javascript
import { GetPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

try {
  const response = await client.send(new GetPublicAccessBlockCommand({ Bucket: "my-bucket" }));
  console.log(response.PublicAccessBlockConfiguration);
} catch (error) {
  if (error.name === "NoSuchPublicAccessBlockConfiguration") {
    console.log("no public access block configuration");
  } else {
    throw error;
  }
}
```

## Related

- [GetBucketAcl](https://docs.strg.com/s3-api/GetBucketAcl) - whether the bucket is public
- [PutBucketAcl](https://docs.strg.com/s3-api/PutBucketAcl)
- [GetBucketPolicy](https://docs.strg.com/s3-api/GetBucketPolicy)
- [Access keys](https://docs.strg.com/access-keys)
- [S3 API overview](https://docs.strg.com/s3-api/overview#supported-operations) - including the [other S3 operations](https://docs.strg.com/s3-api/overview#other-s3-operations)