S3 bucket policy does not allow public write access

Check ID: s3_bucket_policy_public_write_access
Provider: AWS
Service: s3
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 bucket policies are evaluated for public write permissions (e.g., s3:PutObject, s3:Delete*, or s3:*). Account or bucket Public Access Block that restricts public buckets is considered when determining exposure.

Risk

Public write access lets anyone upload, overwrite, or delete objects, undermining integrity and availability. Attackers can plant malware, stage phishing content, poison data, or wipe buckets, causing outages and potential legal and cost impacts from storage abuse and content hosting.

Recommendation

Restrict writes to trusted principals using least privilege; avoid Principal: "*". Enable Public Access Block at account and bucket levels for defense in depth. Prefer IAM roles over broad bucket policies, require private access paths, and enable versioning to recover from unwanted changes.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-public-access-block --bucket <BUCKET_NAME> --public-access-block-configuration RestrictPublicBuckets=true

# Enable bucket-level Public Access Block so public bucket policies (including write) are blocked
resource "aws_s3_bucket_public_access_block" "<example_resource_name>" {
  bucket                   = "<example_resource_id>"
  restrict_public_buckets  = true  # Critical: prevents public access granted via bucket policies
}

# CloudFormation: Enable bucket-level Public Access Block to prevent public policies from granting write
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        RestrictPublicBuckets: true  # Critical: blocks public access granted by any public bucket policy

References

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_policy_public_write_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has object versioning enabled S3 bucket is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires