S3 bucket contents are not publicly listable

Check ID: s3_bucket_public_list_acl
Provider: AWS
Service: s3
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets are evaluated for public listing via ACLs. Grants of READ, READ_ACP, or FULL_CONTROL to the AllUsers or AuthenticatedUsers groups are identified. Effective Block Public Access at account or bucket level (notably IgnorePublicAcls and RestrictPublicBuckets) is considered in the evaluation.

Risk

Public listability reveals object names, counts, and structure, enabling reconnaissance and targeted scraping. READ_ACP exposes permission details for further abuse. With FULL_CONTROL, attackers could alter ACLs and disrupt access, undermining confidentiality and risking integrity and availability.

Recommendation

Enable account-level S3 Block Public Access (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets).

Remove ACL grants to AllUsers/AuthenticatedUsers; apply least privilege with IAM/bucket policies.
Favor private patterns (VPC endpoints, CloudFront OAC, presigned URLs) and disable ACLs via Object Ownership.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true

# Block public listing by enabling bucket-level Public Access Block
resource "aws_s3_bucket_public_access_block" "<example_resource_name>" {
  bucket                 = "<example_resource_id>"
  ignore_public_acls     = true  # Critical: ignore any public ACLs
  restrict_public_buckets = true # Critical: restrict buckets with public policies
}

# CloudFormation: Block public listing via bucket-level Public Access Block
Resources:
  ExamplePublicAccessBlock:
    Type: AWS::S3::BucketPublicAccessBlock
    Properties:
      Bucket: "<example_resource_name>"
      PublicAccessBlockConfiguration:
        IgnorePublicAcls: true        # Critical: ignore any public ACLs so they don't grant list access
        RestrictPublicBuckets: true   # Critical: restrict buckets with public policies to trusted principals

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_public_list_acl. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket is not publicly accessible S3 bucket ACL grants no public write access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires