S3 bucket has Block Public Access enabled

Check ID: s3_bucket_level_public_access_block
Provider: AWS
Service: s3
Severity: HIGH
Categories: internet-exposed
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets are evaluated for Block Public Access settings, ensuring ignore_public_acls and restrict_public_buckets are enabled at the bucket or account scope. Account-wide protections, when present, are treated as effective for the bucket.

Risk

Absent S3 Block Public Access, public ACLs or broad policies can grant Internet or cross-account access.

Data disclosure (confidentiality)
Object overwrite or uploads (integrity)
Deletion or outages from misuse (availability)

Recommendation

Enable Block Public Access at account and bucket levels with block_public_acls, ignore_public_acls, block_public_policy, and restrict_public_buckets set to true. Apply least privilege and defense in depth. If public access is required, narrowly scope policies to fixed principals and conditions.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-public-access-block --bucket <BUCKET_NAME> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true

# Enable required S3 Block Public Access settings on a bucket
resource "aws_s3_bucket_public_access_block" "<example_resource_name>" {
  bucket                   = "<example_resource_id>"
  ignore_public_acls       = true  # CRITICAL: Ignore public ACLs
  restrict_public_buckets  = true  # CRITICAL: Restrict public buckets
}

# CloudFormation - enable required S3 Block Public Access settings on a bucket
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        IgnorePublicAcls: true        # CRITICAL: Ignore public ACLs on the bucket/objects
        RestrictPublicBuckets: true   # CRITICAL: Restrict buckets with public policies to same-account/AWS services

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_level_public_access_block. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has server-side encryption with AWS KMS S3 bucket has a lifecycle configuration enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires