From 32aa1f463c88f16243d6840583e7a2bdd01f512d Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 15 May 2026 16:37:09 -0400
Subject: [PATCH 01/15] Add disable and restore access buttons for private AWS
 projects.

---
 .../console/manage_published_project.html     | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/physionet-django/console/templates/console/manage_published_project.html b/physionet-django/console/templates/console/manage_published_project.html
index eee35cf0e..454f7849b 100644
--- a/physionet-django/console/templates/console/manage_published_project.html
+++ b/physionet-django/console/templates/console/manage_published_project.html
@@ -457,6 +457,29 @@ <h5 class="card-title mt-3 mb-1">AWS</h5>
                     <span class="fa fa-trash"></span>
                     Delete project files
                 </button>
+                {% if project.aws.is_private %}
+                  {% if project.aws.access_points.exists %}
+                    <button class="btn btn-warning"
+                            name="aws-disable-access" value="{{ project.slug }}"
+                            {% if aws_upload_pending or rw_tasks %}
+                              disabled="disabled"
+                            {% endif %}
+                            type="submit">
+                        <span class="fa fa-lock"></span>
+                        Disable access
+                    </button>
+                  {% else %}
+                    <button class="btn btn-success"
+                            name="aws-restore-access" value="{{ project.slug }}"
+                            {% if aws_upload_pending or rw_tasks %}
+                              disabled="disabled"
+                            {% endif %}
+                            type="submit">
+                        <span class="fa fa-lock-open"></span>
+                        Restore access
+                    </button>
+                  {% endif %}
+                {% endif %}
               {% endif %}
             </p>
           </form>

From 2ab0e58acd0eb78e7ccaf32a511128b8c4b06e33 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 15 May 2026 16:37:40 -0400
Subject: [PATCH 02/15] Add handlers for disabling and restoring AWS access.

---
 physionet-django/console/views.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/physionet-django/console/views.py b/physionet-django/console/views.py
index c12994015..5abf763c2 100644
--- a/physionet-django/console/views.py
+++ b/physionet-django/console/views.py
@@ -88,6 +88,8 @@
     check_s3_bucket_exists,
     has_s3_credentials,
     delete_project_files_from_s3,
+    disable_project_access_in_s3,
+    restore_project_access_in_s3,
 )
 
 from django.core.management import call_command
@@ -1175,6 +1177,21 @@ def manage_published_project(request, project_slug, version):
                 # Redirect is required after deletion to avoid rendering the page with
                 # a stale AWS instance that no longer has a primary key in the database.
                 return redirect('manage_published_project', project_slug=project_slug, version=version)
+        elif 'aws-disable-access' in request.POST and has_s3_credentials():
+            if any(get_associated_tasks(project, read_only=False)):
+                messages.error(request, 'Project has tasks pending.')
+            else:
+                disable_project_access_in_s3(project)
+                messages.success(request, 'Access to project files has been disabled.')
+                # Redirect required to avoid rendering with stale AWS instance
+                return redirect('manage_published_project', project_slug=project_slug, version=version)
+        elif 'aws-restore-access' in request.POST and has_s3_credentials():
+            if any(get_associated_tasks(project, read_only=False)):
+                messages.error(request, 'Project has tasks pending.')
+            else:
+                restore_project_access_in_s3(project)
+                messages.success(request, 'Access to project files has been restored.')
+                return redirect('manage_published_project', project_slug=project_slug, version=version)
         elif 'platform' in request.POST:
             data_access_form = forms.DataAccessForm(project=project, data=request.POST)
             if data_access_form.is_valid():

From 5d7960f1ff67c2c7ed92c3abec5f277a8790d679 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 15 May 2026 16:38:15 -0400
Subject: [PATCH 03/15] Add support for disabling and restoring S3 access
 points.

---
 physionet-django/project/cloud/s3.py | 41 ++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/physionet-django/project/cloud/s3.py b/physionet-django/project/cloud/s3.py
index dce7213b8..210e09098 100644
--- a/physionet-django/project/cloud/s3.py
+++ b/physionet-django/project/cloud/s3.py
@@ -1618,3 +1618,44 @@ def delete_project_access_points(project):
     # Deletes AWS, AWSAccessPoint, and AWSAccessPointUser
     # from our database as well via CASCADE
     project.aws.delete()
+
+
+def disable_project_access_in_s3(project):
+    """
+    Temporarily disable access to a private project by deleting its S3 access points
+    without removing the project files from the bucket.
+
+    For public projects, per-project access cannot be disabled without deleting
+    the files, since the bucket policy applies to the entire bucket.
+
+    Args:
+        project (PublishedProject): The project whose access will be disabled.
+    """
+    if not project.aws.is_private:
+        return
+    if not check_s3_bucket_exists(project):
+        return
+
+    s3control = create_s3_control_client()
+    for ap in project.aws.access_points.all():
+        s3control.delete_access_point(
+            AccountId=settings.AWS_ACCOUNT_ID,
+            Name=ap.name
+        )
+    # Only delete AWSAccessPoint records, not the AWS instance itself
+    project.aws.access_points.all().delete()
+
+
+def restore_project_access_in_s3(project):
+    """
+    Restore access to a private project by recreating its S3 access points.
+
+    Args:
+        project (PublishedProject): The project whose access will be restored.
+    """
+    if not project.aws.is_private:
+        return
+    if not check_s3_bucket_exists(project):
+        return
+
+    initialize_access_points(project)

From d2d4c301e7717aa25702ae016418e60c4214b0de Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 15 May 2026 16:53:40 -0400
Subject: [PATCH 04/15] Rename 'Delete project files' button to 'Delete files'.

---
 .../console/templates/console/manage_published_project.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/physionet-django/console/templates/console/manage_published_project.html b/physionet-django/console/templates/console/manage_published_project.html
index 454f7849b..a789a06ec 100644
--- a/physionet-django/console/templates/console/manage_published_project.html
+++ b/physionet-django/console/templates/console/manage_published_project.html
@@ -455,7 +455,7 @@ <h5 class="card-title mt-3 mb-1">AWS</h5>
                         {% endif %}
                         type="submit">
                     <span class="fa fa-trash"></span>
-                    Delete project files
+                    Delete files
                 </button>
                 {% if project.aws.is_private %}
                   {% if project.aws.access_points.exists %}

From 8ba9405526a2c161343fb7faff621e6a171885ee Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 15 May 2026 16:59:27 -0400
Subject: [PATCH 05/15] Update button colors for AWS cloud management actions.

---
 .../console/templates/console/manage_published_project.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/physionet-django/console/templates/console/manage_published_project.html b/physionet-django/console/templates/console/manage_published_project.html
index a789a06ec..f4a8a977a 100644
--- a/physionet-django/console/templates/console/manage_published_project.html
+++ b/physionet-django/console/templates/console/manage_published_project.html
@@ -448,7 +448,7 @@ <h5 class="card-title mt-3 mb-1">AWS</h5>
                 {% endif %}
               </button>
               {% if project.aws.sent_files %}
-                <button class="btn btn-primary"
+                <button class="btn btn-danger"
                         name="aws-delete-project-files" value="{{ project.slug }}"
                         {% if aws_upload_pending or rw_tasks %}
                           disabled="disabled"

From 0b5dc0a436057efdd281020432ddc0237d967baa Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 15 May 2026 17:15:11 -0400
Subject: [PATCH 06/15] Fix Enable AWS access button visibility when access
 points are disabled.

---
 .../project/templates/project/published_project.html            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/physionet-django/project/templates/project/published_project.html b/physionet-django/project/templates/project/published_project.html
index 194ff335c..de451679f 100644
--- a/physionet-django/project/templates/project/published_project.html
+++ b/physionet-django/project/templates/project/published_project.html
@@ -351,7 +351,7 @@ <h5>Access the files</h5>
               To download the files using AWS command line tools, first
               <a href="{% url 'edit_cloud' %}">configure your AWS credentials</a>.
             </li>
-          {% elif not user_in_access_point_policy %}
+           {% elif project.aws.access_points.exists %}
             <li>
               Click to access the files using AWS command line tools:
               <form method="post" action="{% url 'enable_aws_access' project.slug project.version %}">

From 36143416c35beeebae1246ccbe232b780c482d18 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 22 May 2026 14:29:13 -0400
Subject: [PATCH 07/15] Add disable and restore S3 access functions.

---
 physionet-django/project/cloud/s3.py | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/physionet-django/project/cloud/s3.py b/physionet-django/project/cloud/s3.py
index 210e09098..f69d77300 100644
--- a/physionet-django/project/cloud/s3.py
+++ b/physionet-django/project/cloud/s3.py
@@ -1623,7 +1623,8 @@ def delete_project_access_points(project):
 def disable_project_access_in_s3(project):
     """
     Temporarily disable access to a private project by deleting its S3 access points
-    without removing the project files from the bucket.
+    without removing the project files from the bucket. Sets
+    access_disabled=True to prevent users from re-enabling access.
 
     For public projects, per-project access cannot be disabled without deleting
     the files, since the bucket policy applies to the entire bucket.
@@ -1645,10 +1646,15 @@ def disable_project_access_in_s3(project):
     # Only delete AWSAccessPoint records, not the AWS instance itself
     project.aws.access_points.all().delete()
 
+    # Set explicit flag to prevent users from re-enabling access
+    project.aws.access_disabled = True
+    project.aws.save()
+
 
 def restore_project_access_in_s3(project):
     """
-    Restore access to a private project by recreating its S3 access points.
+    Restore access to a private project by recreating its S3 access points
+    and clearing the access_disabled flag.
 
     Args:
         project (PublishedProject): The project whose access will be restored.
@@ -1659,3 +1665,6 @@ def restore_project_access_in_s3(project):
         return
 
     initialize_access_points(project)
+
+    project.aws.access_disabled = False
+    project.aws.save()

From 33d9aa45d8eefe15e33465c1453b1a47920a9473 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 22 May 2026 14:31:26 -0400
Subject: [PATCH 08/15] Add a flag to AWS model to track disabled access.

---
 physionet-django/project/modelcomponents/storage.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/physionet-django/project/modelcomponents/storage.py b/physionet-django/project/modelcomponents/storage.py
index 6391e60a7..b9609d39d 100644
--- a/physionet-django/project/modelcomponents/storage.py
+++ b/physionet-django/project/modelcomponents/storage.py
@@ -61,6 +61,7 @@ class AWS(models.Model):
     sent_files = models.BooleanField(default=False)
     creation_datetime = models.DateTimeField(auto_now_add=True)
     finished_datetime = models.DateTimeField(null=True)
+    access_disabled = models.BooleanField(default=False)
 
     class Meta:
         default_permissions = ()

From cb313b0c6b29c314d4f19622c7fdd7a591f81b48 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 22 May 2026 14:33:37 -0400
Subject: [PATCH 09/15] Block users from enabling AWS access when access is
 disabled for that project.

---
 physionet-django/project/views.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/physionet-django/project/views.py b/physionet-django/project/views.py
index 2f470b1cf..9d5ee2382 100644
--- a/physionet-django/project/views.py
+++ b/physionet-django/project/views.py
@@ -2160,6 +2160,7 @@ def sign_dua(request, project_slug, version):
                     hasattr(user, 'cloud_information')
                     and user.cloud_information is not None
                     and user.cloud_information.aws_verification_datetime is not None
+                    and not project.aws.access_disabled
                 ):
                     add_user_to_access_point_policy(project, user)
 
@@ -2336,6 +2337,10 @@ def enable_aws_access(request, project_slug, version):
         messages.error(request, 'You do not have permission to access this project.')
         return redirect('published_project', project_slug=project_slug, version=version)
 
+    # Block if access has been explicitly disabled by an admin
+    if hasattr(project, 'aws') and project.aws.access_disabled:
+        return redirect('published_project', project_slug=project_slug, version=version)
+
     if request.method == 'POST':
         if has_s3_credentials() and files_sent_to_S3(project):
             if (

From 6bf0ff8e49f16243f78b292a274066b719664395 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 22 May 2026 14:34:19 -0400
Subject: [PATCH 10/15] Hide Enable AWS access button when access is disabled.

---
 .../templates/project/published_project.html  | 42 +++++++++----------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/physionet-django/project/templates/project/published_project.html b/physionet-django/project/templates/project/published_project.html
index de451679f..875e82b06 100644
--- a/physionet-django/project/templates/project/published_project.html
+++ b/physionet-django/project/templates/project/published_project.html
@@ -341,27 +341,27 @@ <h5>Access the files</h5>
           {% endif %}
 
           {% if has_s3_credentials and project.aws.sent_files %}
-          {% if s3_uri %}
-            <li>
-              Download the files using AWS command line tools:
-              <pre class="shell-command">aws s3 sync {{ s3_uri }} DESTINATION</pre>
-            </li>
-          {% elif show_aws_configuration_link %}
-            <li>
-              To download the files using AWS command line tools, first
-              <a href="{% url 'edit_cloud' %}">configure your AWS credentials</a>.
-            </li>
-           {% elif project.aws.access_points.exists %}
-            <li>
-              Click to access the files using AWS command line tools:
-              <form method="post" action="{% url 'enable_aws_access' project.slug project.version %}">
-                {% csrf_token %}
-                <button class="btn btn-primary btn-fixed" type="submit">
-                  Enable AWS access
-                </button>
-              </form>
-            </li>
-          {% endif %}
+            {% if s3_uri %}
+              <li>
+                Download the files using AWS command line tools:
+                <pre class="shell-command">aws s3 sync {{ s3_uri }} DESTINATION</pre>
+              </li>
+            {% elif show_aws_configuration_link %}
+              <li>
+                To download the files using AWS command line tools, first
+                <a href="{% url 'edit_cloud' %}">configure your AWS credentials</a>.
+              </li>
+            {% elif not project.aws.access_disabled and not user_in_access_point_policy %}
+              <li>
+                Click to access the files using AWS command line tools:
+                <form method="post" action="{% url 'enable_aws_access' project.slug project.version %}">
+                  {% csrf_token %}
+                  <button class="btn btn-primary btn-fixed" type="submit">
+                    Enable AWS access
+                  </button>
+                </form>
+              </li>
+            {% endif %}
           {% endif %}
 
         </ul>

From 8fc4f0bc44d75c19e21168cf644539ef6805ee1f Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 22 May 2026 14:35:01 -0400
Subject: [PATCH 11/15] Use access_disabled flag to control disable and restore
 access buttons.

---
 .../console/manage_published_project.html     | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/physionet-django/console/templates/console/manage_published_project.html b/physionet-django/console/templates/console/manage_published_project.html
index f4a8a977a..a1d1ad0a5 100644
--- a/physionet-django/console/templates/console/manage_published_project.html
+++ b/physionet-django/console/templates/console/manage_published_project.html
@@ -458,16 +458,18 @@ <h5 class="card-title mt-3 mb-1">AWS</h5>
                     Delete files
                 </button>
                 {% if project.aws.is_private %}
-                  {% if project.aws.access_points.exists %}
-                    <button class="btn btn-warning"
-                            name="aws-disable-access" value="{{ project.slug }}"
-                            {% if aws_upload_pending or rw_tasks %}
-                              disabled="disabled"
-                            {% endif %}
-                            type="submit">
-                        <span class="fa fa-lock"></span>
-                        Disable access
-                    </button>
+                  {% if not project.aws.access_disabled %}
+                    {% if project.aws.access_points.exists %}
+                      <button class="btn btn-warning"
+                              name="aws-disable-access" value="{{ project.slug }}"
+                              {% if aws_upload_pending or rw_tasks %}
+                                disabled="disabled"
+                              {% endif %}
+                              type="submit">
+                          <span class="fa fa-lock"></span>
+                          Disable access
+                      </button>
+                    {% endif %}
                   {% else %}
                     <button class="btn btn-success"
                             name="aws-restore-access" value="{{ project.slug }}"

From 3d5d255fe387b573ebc453fa191e7a61aecd0d07 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 22 May 2026 14:35:26 -0400
Subject: [PATCH 12/15] Add tests for disabling and restoring S3 access.

---
 physionet-django/project/test_s3.py | 106 ++++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)

diff --git a/physionet-django/project/test_s3.py b/physionet-django/project/test_s3.py
index 0a45cba63..7539382ff 100644
--- a/physionet-django/project/test_s3.py
+++ b/physionet-django/project/test_s3.py
@@ -20,6 +20,8 @@
     get_bucket_name,
     has_s3_credentials,
     upload_project_to_S3,
+    disable_project_access_in_s3,
+    restore_project_access_in_s3,
 )
 from project.models import (
     AWS,
@@ -408,3 +410,107 @@ def create_example_users(self, project, count, aws_verified, signed_dua):
                 user.dua_signatures.create(project=project)
 
         return users
+
+    def test_disable_project_access(self):
+        """
+        Test that disabling access deletes access points from S3 and
+        sets access_disabled=True without deleting project files.
+        """
+        create_s3_server_access_log_bucket()
+
+        project = PublishedProject.objects.get(slug='demoeicu', version='2.0.0')
+
+        # Create users and upload project
+        _ = self.create_example_users(
+            project=project, count=5, aws_verified=True, signed_dua=True
+        )
+        aws = AWS.objects.create(
+            project=project,
+            bucket_name=get_bucket_name(project),
+            is_private=True,
+        )
+        upload_project_to_S3(project)
+        aws.sent_files = True
+        aws.save()
+
+        self.assertGreater(aws.access_points.count(), 0)
+        self.assertFalse(aws.access_disabled)
+
+        # Disable access
+        disable_project_access_in_s3(project)
+
+        aws.refresh_from_db()
+        self.assertEqual(aws.access_points.count(), 0)
+        self.assertTrue(aws.access_disabled)
+
+        # Files should still exist in S3
+        self.assertTrue(check_s3_bucket_exists(project))
+        self.assert_project_files_uploaded([project])
+
+    def test_restore_project_access(self):
+        """
+        Test that restoring access recreates access points and clears access_disabled.
+        """
+        create_s3_server_access_log_bucket()
+
+        project = PublishedProject.objects.get(slug='demoeicu', version='2.0.0')
+
+        users = self.create_example_users(
+            project=project, count=5, aws_verified=True, signed_dua=True
+        )
+        aws = AWS.objects.create(
+            project=project,
+            bucket_name=get_bucket_name(project),
+            is_private=True,
+        )
+        upload_project_to_S3(project)
+        aws.sent_files = True
+        aws.save()
+
+        # Disable then restore
+        disable_project_access_in_s3(project)
+
+        aws.refresh_from_db()
+        self.assertTrue(aws.access_disabled)
+        self.assertEqual(aws.access_points.count(), 0)
+
+        restore_project_access_in_s3(project)
+
+        aws.refresh_from_db()
+        self.assertFalse(aws.access_disabled)
+        self.assertGreater(aws.access_points.count(), 0)
+        self.assert_project_users_authorized(project, users)
+
+    def test_disable_access_blocks_enable_aws_access(self):
+        """
+        Test that a user cannot enable AWS access when access_disabled=True.
+        """
+        create_s3_server_access_log_bucket()
+
+        project = PublishedProject.objects.get(slug='demoeicu', version='2.0.0')
+
+        users = self.create_example_users(
+            project=project, count=2, aws_verified=True, signed_dua=True
+        )
+        aws = AWS.objects.create(
+            project=project,
+            bucket_name=get_bucket_name(project),
+            is_private=True,
+        )
+        upload_project_to_S3(project)
+        aws.sent_files = True
+        aws.save()
+
+        disable_project_access_in_s3(project)
+
+        # User tries to enable AWS access — should be blocked
+        user = users[0]
+        self.client.force_login(user)
+        self.client.post(
+            reverse('enable_aws_access', args=(project.slug, project.version))
+        )
+
+        aws.refresh_from_db()
+        # Access points should still be empty
+        self.assertEqual(aws.access_points.count(), 0)
+        self.assertTrue(aws.access_disabled)

From 895bf65efc05ffa0f00165d80462fafe2b031836 Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Fri, 22 May 2026 15:48:53 -0400
Subject: [PATCH 13/15] Allow access_disabled to be null to avoid breaking
 tests.

---
 .../migrations/0097_aws_access_disabled.py      | 17 +++++++++++++++++
 .../project/modelcomponents/storage.py          |  2 +-
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 physionet-django/project/migrations/0097_aws_access_disabled.py

diff --git a/physionet-django/project/migrations/0097_aws_access_disabled.py b/physionet-django/project/migrations/0097_aws_access_disabled.py
new file mode 100644
index 000000000..8d6a20104
--- /dev/null
+++ b/physionet-django/project/migrations/0097_aws_access_disabled.py
@@ -0,0 +1,17 @@
+# Generated by Django 4.2.20 on 2026-05-22 19:45
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("project", "0096_activeproject_checksums_2"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="aws",
+            name="access_disabled",
+            field=models.BooleanField(default=False, null=True),
+        ),
+    ]
diff --git a/physionet-django/project/modelcomponents/storage.py b/physionet-django/project/modelcomponents/storage.py
index b9609d39d..1d9c5398e 100644
--- a/physionet-django/project/modelcomponents/storage.py
+++ b/physionet-django/project/modelcomponents/storage.py
@@ -61,7 +61,7 @@ class AWS(models.Model):
     sent_files = models.BooleanField(default=False)
     creation_datetime = models.DateTimeField(auto_now_add=True)
     finished_datetime = models.DateTimeField(null=True)
-    access_disabled = models.BooleanField(default=False)
+    access_disabled = models.BooleanField(default=False, null=True)
 
     class Meta:
         default_permissions = ()

From 87838a7229add1b40ca749752d7f2be6b1e1741f Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Thu, 4 Jun 2026 16:12:51 -0400
Subject: [PATCH 14/15] Hide aws credentials configuration when access is
 disabled.

---
 .../project/templates/project/published_project.html          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/physionet-django/project/templates/project/published_project.html b/physionet-django/project/templates/project/published_project.html
index 875e82b06..7305c0539 100644
--- a/physionet-django/project/templates/project/published_project.html
+++ b/physionet-django/project/templates/project/published_project.html
@@ -340,7 +340,7 @@ <h5>Access the files</h5>
             </li>
           {% endif %}
 
-          {% if has_s3_credentials and project.aws.sent_files %}
+          {% if has_s3_credentials and project.aws.sent_files and not project.aws.access_disabled %}
             {% if s3_uri %}
               <li>
                 Download the files using AWS command line tools:
@@ -351,7 +351,7 @@ <h5>Access the files</h5>
                 To download the files using AWS command line tools, first
                 <a href="{% url 'edit_cloud' %}">configure your AWS credentials</a>.
               </li>
-            {% elif not project.aws.access_disabled and not user_in_access_point_policy %}
+            {% elif not user_in_access_point_policy %}
               <li>
                 Click to access the files using AWS command line tools:
                 <form method="post" action="{% url 'enable_aws_access' project.slug project.version %}">

From d6031d401f1a15b26a74a323eae92a6a4241f81c Mon Sep 17 00:00:00 2001
From: chrystinne <chrystinne@gmail.com>
Date: Thu, 4 Jun 2026 16:25:58 -0400
Subject: [PATCH 15/15] Merge migrations.

---
 ...097_aws_access_disabled_0098_add_review_models.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 physionet-django/project/migrations/0099_merge_0097_aws_access_disabled_0098_add_review_models.py

diff --git a/physionet-django/project/migrations/0099_merge_0097_aws_access_disabled_0098_add_review_models.py b/physionet-django/project/migrations/0099_merge_0097_aws_access_disabled_0098_add_review_models.py
new file mode 100644
index 000000000..90f39cbc9
--- /dev/null
+++ b/physionet-django/project/migrations/0099_merge_0097_aws_access_disabled_0098_add_review_models.py
@@ -0,0 +1,12 @@
+# Generated by Django 4.2.20 on 2026-06-04 20:25
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("project", "0097_aws_access_disabled"),
+        ("project", "0098_add_review_models"),
+    ]
+
+    operations = []