Geofencing and bucket policy

Geofencing

Blocks or allows requests by the country of the source IP at the region's gateway, before RGW sees the request. It applies to the S3 endpoint, path-style and virtual-host style, and to the custom domain.

Setting	Value
mode	allow: only the listed countries pass; deny: the listed countries are blocked
countries	one or more ISO 3166-1 alpha-2 codes, uppercase (DE, AT, CH)
exempt_crawlers	default on: Google and Bing crawler addresses are never blocked

Blocked requests get 403. The ZERO-PROTECT edge addresses are always exempt, because a domain fronted by ZERO-PROTECT reaches the gateway from the edge, not from the visitor; geofence such domains at the edge instead. The ACME challenge path stays reachable in allow mode.

Bucket policy presets

The portal offers two presets:

Preset	Effect
private (default)	no bucket policy; only authenticated keys of the account can read and write
public-read	s3:GetObject for everyone on arn:aws:s3:::<bucket>/*; needed for static hosting and public downloads

public-read writes exactly this policy to the bucket:

{"Version": "2012-10-17", "Statement": [{"Sid": "PublicRead", "Effect": "Allow",
  "Principal": "*", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::<bucket>/*"]}]}

Custom policies

Anything beyond the presets (per-user rights, prefix restrictions, IP conditions) is set with the S3 API, for example aws s3api put-bucket-policy --bucket <bucket> --policy file://policy.json. Selecting a preset in the portal afterwards replaces your policy: public-read overwrites it, private deletes it.

Presigned URLs

Time-limited access to one object without sharing keys: aws s3 presign, mc share download, or generate_presigned_url in boto3. The URL must be built against the same endpoint host the client signs for. Presigned URLs are subject to geofencing like every other request.