S3 bucket ACL grants no public write access

Check ID: s3_bucket_public_write_acl
Provider: AWS
Service: s3
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets are assessed for ACL grants that allow public write access to AllUsers or AuthenticatedUsers via WRITE, WRITE_ACP, or FULL_CONTROL. Effective Block Public Access at account or bucket level (ignore_public_acls, restrict_public_buckets) is considered.

Risk

Public or cross-account writes enable object tampering, log poisoning, and ACL changes via WRITE_ACP, undermining integrity and causing covert data exposure. Attackers can plant malware, deface content, and inflate costs, impacting availability through overwrites or prefix flooding.

Recommendation

Apply least privilege to S3 writes. Enable account-level Block Public Access and use Object Ownership to disable ACLs. Grant write only to fixed principals via bucket policies with tight conditions (e.g., org IDs, VPC endpoints). Add versioning and monitoring for defense-in-depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-acl —bucket <bucket_name> —acl private

# Ensure the bucket is not publicly writable via ACLs
resource "aws_s3_bucket_public_access_block" "<example_resource_name>" {
  bucket                  = "<example_resource_name>"
  ignore_public_acls      = true  # Critical: disables effect of public ACLs (e.g., AllUsers/AuthenticatedUsers)
  restrict_public_buckets = true  # Critical: restricts public buckets to the account to prevent public writes
}

# CloudFormation: ensure bucket is not publicly writable via ACLs
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        IgnorePublicAcls: true       # Critical: ignores any public ACLs (e.g., AllUsers/AuthenticatedUsers) so write grants don't apply
        RestrictPublicBuckets: true  # Critical: restricts public buckets to the account, preventing public writes via policies

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_public_write_acl. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket contents are not publicly listable S3 bucket policy denies requests over insecure transport

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires