All checks
High
S3 general purpose buckets should block public access
Checks that all four Block Public Access settings are on for the S3 general purpose bucket itself; the account-level settings do not count here. With them on, no policy or ACL can make the bucket public, even if the account-level settings are later turned off.
- service
- S3
- severity
- High
- scope
- evaluated once per account
How to fix it
In the console
S3 → the bucket → Permissions → Block public access (bucket settings)
With the AWS CLI
aws s3api put-public-access-block --bucket <bucket> --public-access-block-configuration BlockPublicAcls=true,BlockPublicPolicy=true,IgnorePublicAcls=true,RestrictPublicBuckets=trueWith Terraform
resource "aws_s3_bucket_public_access_block" "this" {
bucket = aws_s3_bucket.this.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}See which of your accounts this check is failing on.
Book a demo