Making a bucket public used to mean making all of it public. If you wanted to serve images in your emails or on your site, you either exposed everything else in the bucket too, or kept a second bucket just for public files.
Choose what is served
When you turn on public access or the CDN, you can now pick Specific folders instead of Whole bucket. Only objects under those folders are served without credentials, on the public URL and the CDN alike. Everything else in the bucket still needs an access key.
A folder covers everything beneath it, so images/ serves
images/logo.png and images/2026/hero.jpg. You can list up to 10.
CDN on a private bucket
The CDN no longer requires public access. Turn it on for a private bucket and the CDN URL becomes the only way to read objects without credentials. The bucket's own public URL stays closed.
Existing buckets are unchanged: they keep serving the whole bucket until you choose folders on the bucket's overview page.
See Public Access & CDN in the object storage guide.