S3 bucket is not publicly accessible

Check ID: s3_bucket_public_access
Provider: AWS
Service: s3
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets are evaluated for public access via ACLs and bucket policies. The check identifies account or bucket PublicAccessBlock protections (IgnorePublicAcls, RestrictPublicBuckets) and flags buckets granting group access to AllUsers or AuthenticatedUsers, or with a public bucket policy.

Risk

Publicly accessible buckets jeopardize confidentiality through unauthenticated reads, integrity through write or ACL changes, and availability via object deletion or overwrite. Attackers can mass-exfiltrate data, host malware, or pivot after discovering secrets stored in objects.

Recommendation

Enforce defense in depth: enable S3 Block Public Access at org/account and bucket levels (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets). Apply least privilege with explicit principals; avoid ACLs via Object Ownership. Use private access patterns (e.g., CloudFront OAC or presigned URLs) and monitor with analyzers.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true

# Enable minimal S3 Block Public Access on the bucket
resource "aws_s3_bucket_public_access_block" "example" {
  bucket = "<example_resource_name>"

  ignore_public_acls     = true  # Critical: ignores public ACLs
  restrict_public_buckets = true # Critical: restricts buckets with public policies
}

# CloudFormation: Enable minimal S3 Block Public Access on the bucket
Resources:
  ExampleBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        IgnorePublicAcls: true        # Critical: ignores any public ACL grants (AllUsers/AuthenticatedUsers)
        RestrictPublicBuckets: true   # Critical: restricts buckets with public policies to same-account/service principals

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket policy does not allow public write access S3 bucket contents are not publicly listable

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires