S3 bucket must block all public access

Critical AWS General aws-s3-bucket-no-public-access

Applies to

AWS::S3::Bucket

What CGPulse checks

A resource passes this rule when blockPublicAcls must equal true AND blockPublicPolicy must equal true AND ignorePublicAcls must equal true AND restrictPublicBuckets must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable all Block Public Access settings to prevent accidental data exposure. In AWS Console: S3 > Bucket > Permissions > Block public access > enable all. See: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

Terraform

resource "aws_s3_bucket_public_access_block" "{name}" {
  bucket                  = aws_s3_bucket.{name}.id
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

Compliance frameworks

Cloud Foundations Benchmark v3.02.1.1
GDPR: Data Protection Controls
ISO 27001: Information SecurityA.13.1.1
NIST 800-53: Cloud Security ControlsSC-7
PCI DSS v4.01.3.2
SOC 2: Trust ServicesCC6.6

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan