All checks
Critical
S3 general purpose buckets should block public read access
Checks whether an S3 general purpose bucket's policy or ACL grants public read access that Block Public Access, on the bucket or the account, does not override. Such a grant opens the bucket's contents to anyone on the internet.
- service
- S3
- severity
- Critical
- scope
- evaluated once per account
How to fix it
In the console
S3 → the bucket → Permissions → Block public access (bucket settings)
With the AWS CLI
aws s3api put-public-access-block --bucket <bucket> --public-access-block-configuration BlockPublicAcls=true,BlockPublicPolicy=true,IgnorePublicAcls=true,RestrictPublicBuckets=trueWith Terraform
resource "aws_s3_bucket_public_access_block" "this" {
bucket = aws_s3_bucket.this.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}See which of your accounts this check is failing on.
Book a demo