Open source models are growing fast, and storing them in AWS S3 is now the norm. But when you open them up to the world, you need strict control. Read-only roles give you that control. They let you share data without the risk of edits, deletions, or overwrites. Done right, they make S3 a secure public library instead of a public dumpster.
Why AWS S3 Read-Only Roles Matter for Open Source Models
Open source machine learning models often weigh gigabytes. Hosting them on S3 means fast download speeds, high availability, and low friction for users. But without read-only IAM policies, you risk accidental or malicious changes. That’s not just bad for your model—it’s a security hole.
How to Create a Read-Only Role in AWS S3
- Open the AWS IAM console.
- Create a new role and choose the "AWS Service" or "Trusted entity" type based on your use case.
- Attach the
AmazonS3ReadOnlyAccesspolicy. This grants access to GET objects and list buckets, but denies PUT, POST, or DELETE. - Scope down permissions with bucket-specific restrictions if needed:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::your-bucket-name",
"arn:aws:s3:::your-bucket-name/*"
]
}
]
}
- Test your role. Use the AWS CLI:
aws s3 ls s3://your-bucket-name --profile your-readonly-profile
Ensure that uploads and deletes fail.