All checks
Critical
S3 access points should have block public access settings enabled
Checks that an S3 access point has all four Block Public Access settings on. S3 combines them with the bucket's and the account's settings and applies the most restrictive, so with them on, this access point cannot make the bucket's data public.
- service
- S3
- severity
- Critical
- scope
- evaluated once per account
How to fix it
In the console
S3 → Access Points → Create access point
With the AWS CLI
aws s3control create-access-point --account-id <account-id> --name <access-point> --bucket <bucket> --public-access-block-configuration BlockPublicAcls=true,BlockPublicPolicy=true,IgnorePublicAcls=true,RestrictPublicBuckets=trueWith Terraform
resource "aws_s3_access_point" "this" {
bucket = aws_s3_bucket.this.id
name = "example"
public_access_block_configuration {
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
}See which of your accounts this check is failing on.
Book a demo