OK, discussing this more, we think it's fine to just give ListBucket to everyone. The bucket is already public (i.e. GetObject is already effectively open), and we don't see a concern with allowing listing as well.

So the policy should be:

{
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": "*",
         "Action": [
           "s3:GetObject",
           "s3:ListBucket"
         ],
         "Resource": [
            "arn:aws:s3:::fcos-builds",
            "arn:aws:s3:::fcos-builds/*"
         ]
      }
   ]
}

And the exact command is:

aws s3api put-bucket-policy --bucket fcos-builds --policy file://bucket-policy.json

sad trombone: An error occurred (AccessDenied) when calling the PutBucketPolicy operation: User: arn:aws:iam:::user/kevin is not authorized to perform: s3:PutBucketPolicy on resource: "arn:aws:s3:::fcos-builds" because public policies are blocked by the BlockPublicPolicy block public access setting.

these two are checked / on:

Block public access to buckets and objects granted through new public bucket or access point policies
S3 will block new bucket and access point policies that grant public access to buckets and objects. This setting doesn't change any existing policies that allow public access to S3 resources.

Block public and cross-account access to buckets and objects through any public bucket or access point policies
S3 will ignore public and cross-account access for buckets or access points with policies that grant public access to buckets and objects.
shall I uncheck them both and retry the policy?

Shall I uncheck those?

I unchecked them, it allowed me to set the policy then.

Can you check that it's working as expected now?

Yes it does, thanks all!

$ curl -LI https://builds.coreos.fedoraproject.org/enoent | head -n1
HTTP/2 404