S3 bucket must block public ACLs

Critical AWS General aws-s3-bucket-bucket-block-public-acls

Applies to

AWS::S3::Bucket

What CGPulse checks

A resource passes this rule when blockPublicAcls must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable Block Public ACLs to prevent public access grants through ACLs. In AWS Console: S3 > Bucket > Permissions > Block public access > enable Block public ACLs. See: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

CLI

aws s3api put-public-access-block --bucket "{name}" --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Terraform

resource "aws_s3_bucket_public_access_block" "{name}" {
  bucket                  = aws_s3_bucket.{name}.id
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

Compliance frameworks

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan