S3 account-level Block Public Access is enabled

Check ID: s3_account_level_public_access_blocks
Provider: AWS
Service: s3
Severity: HIGH
Categories: internet-exposed
Resource type: AwsS3AccountPublicAccessBlock

What this check verifies

Amazon S3 account-level Block Public Access is assessed for ignore_public_acls and restrict_public_buckets to confirm centralized blocking of ACL-based public access and limiting buckets with public policies to in-account principals.

Risk

Absent these settings, public ACLs and broad bucket policies may grant internet or cross-account access. This risks:

Confidentiality: bulk data exfiltration
Integrity: object overwrite/tampering
Availability: malicious deletions or malware hosting, triggering takedowns

Recommendation

Turn on account-level Block Public Access (prefer enabling all four: block_public_acls, ignore_public_acls, block_public_policy, restrict_public_buckets) to enforce least privilege. For legitimate access, use private buckets with CloudFront, VPC endpoints, or presigned URLs. Regularly review policies with IAM Access Analyzer.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3control put-public-access-block --account-id <account_id> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true

# Terraform: Enable required S3 Account-level Block Public Access settings
resource "aws_s3_account_public_access_block" "<example_resource_name>" {
  ignore_public_acls     = true  # Critical: Ignores any public ACLs account-wide
  restrict_public_buckets = true # Critical: Restricts buckets with public policies to same-account principals
}

# CloudFormation: Enable required S3 Account-level Block Public Access settings
Resources:
  <example_resource_name>:
    Type: AWS::S3::AccountPublicAccessBlock
    Properties:
      AccountId: !Ref AWS::AccountId
      IgnorePublicAcls: true         # Critical: Ignores any public ACLs at the account level
      RestrictPublicBuckets: true    # Critical: Restricts buckets with public policies to only same-account principals

References

https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_account_level_public_access_blocks. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 access point has all Block Public Access settings enabled S3 bucket has bucket ACLs disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires