Check ID: s3_access_point_public_access_block
Provider: AWS
Service: s3
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsS3AccessPoint

​
What this check verifies

Amazon S3 access points have Block Public Access configured with all settings enabled: block_public_acls, ignore_public_acls, block_public_policy, and restrict_public_buckets. The evaluation inspects each access point’s public access block configuration.

​
Risk

Without block public access on an access point, ACLs or policies can expose objects publicly despite intended restrictions. This enables unauthorized reads (confidentiality loss), writes or deletions (integrity/availability impact), and supports bulk data exfiltration or destructive actions.

​
Recommendation

Enable all access-point Block Public Access settings (block_public_acls, ignore_public_acls, block_public_policy, restrict_public_buckets). Apply least privilege, prefer VPC-only access points, and layer account and bucket blocks for defense in depth. Regularly audit for public principals like Principal: *.

​
Remediation

# Terraform: S3 Access Point with all Block Public Access settings enabled
resource "aws_s3_access_point" "<example_resource_name>" {
  name   = "<example_resource_name>"
  bucket = "<example_bucket_name>"

  public_access_block_configuration {
    block_public_acls       = true  # Critical: block public ACLs
    ignore_public_acls      = true  # Critical: ignore any public ACLs
    block_public_policy     = true  # Critical: block public policies
    restrict_public_buckets = true  # Critical: restrict public buckets
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_access_point_public_access_block. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks