Check ID: s3_multi_region_access_point_public_access_block
Provider: AWS
Service: s3
Severity: HIGH
Categories: internet-exposed
Resource type: AwsS3AccessPoint

​
What this check verifies

Amazon S3 Multi-Region Access Points are evaluated for Block Public Access being fully enabled (block_public_acls, ignore_public_acls, block_public_policy, restrict_public_buckets). Focus is on the MRAP’s own settings, separate from bucket or account configurations.

​
Risk

Without MRAP Block Public Access, the global endpoint can accept internet traffic, exposing linked buckets. This undermines confidentiality (object listing/reads) and integrity (unauthorized writes or policy abuse), and can trigger costly egress and data tampering across Regions.

​
Recommendation

Adopt deny-by-default: keep all MRAP Block Public Access settings enabled; avoid public ACLs or policies.
  • Enforce least privilege
  • Prefer private access (VPC endpoints)
  • Periodically review permissions and logs
MRAP public access settings are immutable after creation.

​
Remediation

# Terraform: MRAP with Block Public Access enabled (must be set at creation)
resource "aws_s3control_multi_region_access_point" "<example_resource_name>" {
  account_id = "<example_account_id>"

  details {
    name = "<example_resource_name>"

    public_access_block {                 # Critical: enable all Block Public Access settings
      block_public_acls       = true      # Critical
      ignore_public_acls      = true      # Critical
      block_public_policy     = true      # Critical
      restrict_public_buckets = true      # Critical
    }

    region { bucket = "<example_bucket_name_1>" }
    region { bucket = "<example_bucket_name_2>" }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_multi_region_access_point_public_access_block. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks